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Abstract 

Quantum optical Gaussian states are a type of important robust quantum states 
which are manipulatable by the existing technologies. So far, most of the impor- 
tant quantum information experiments are done with such states, including bright 
Gaussian light and weak Gaussian light. Extending the existing results of quantum 
information with discrete quantum states to the case of continuous variable quan- 
tum states is an interesting theoretical job. The quantum Gaussian states play a 
central role in such a case. We review the properties and applications of Gaussian 
states in quantum information with emphasis on the fundamental concepts, the 
<^ ■ calculation techniques and the effects of imperfections of the real-life experimental 

setups. Topics here include the elementary properties of Gaussian states and relevant 
quantum information device, entanglement-based quantum tasks such as quantum 
teleportation, quantum cryptography with weak and strong Gaussian states and 
^ . the quantum channel capacity, mathematical theory of quantum entanglement and 

H ' state estimation for Gaussian states. 

Contents 

1 Introduction [3 

1.1 Elements of quantum information with 2- level states 

1.2 Phase space representation and definition of Gaussian states 

1.3 Coherent states LLa 



1 Email: xbwang@mail.tsinghua.edu.cn 

2 Email: tohya@qci.jst.go.jp 



Preprint submitted to Elsevier Science 



3 February 2008 



1.4 Squeezed states 

1.5 Beam-splitter 

1.6 Beam-splitter as an entangler 

2 Entanglement-based quantum tasks 

2.1 Teleportation with two-level states 

2.2 CVQT with Gaussian states 

2.3 Experiment 

2.4 Dense coding with two-mode squeezed states 

2.5 Quantum error correction codes 

2.6 Gaussian cloning transformation 

2.7 Entanglement-based quantum tasks with weak Gaussian states: 
post-selection vs non-post-selection 

3 Quantum cryptography with weak coherent light 

3.1 Introduction 

3.2 QKD in practice 

3.3 Eavesdropping and security 

3.4 Ideas of unconditional security proof 

4 Security proofs and protocols of QKD with weak and strong 
Gaussian states 

4.1 Entanglement purification and security proof of QKD 

4.2 Secure key distillation with a known fraction of tagged bits 

4.3 Decoy-state method 

4.4 SARG04 protocol 

4.5 QKD in position-momentum space 

4.6 Security proof of QKD with squeezed states 

5 Mathematical theory of quantum entanglement with Gaussian states 



5.1 General Properties of Quantum Entanglement IllC 

5.2 Entanglement Properties of Gaussian States 1 112 

5.3 Conclusions 1 127 

6 Classical capacities of Gaussian channels Il28 

6.1 Classical Capacities of Quantum Channels 1 128 

6.2 Gaussian Channels 1 13C 

6.3 Gaussian Channels with Gaussian Inputs 1 136 

6.4 Dense Coding with Gaussian Entanglement |14C 

6.5 Entanglement measure 1 142 

7 Estimation theory for Gaussian states 1 142 

7.1 Information quantities 1 143 

7.2 Measurement theory Il45 

7.3 Formulation of estimation ll4S 

7.4 Independent and identical condition |15C 

7.5 Bayesian method 1 15 1 

7.6 Group covariant method 1 153 

7.7 Unbiased method Il54 

7.8 Simple hypothesis testing 1 156 

8 Acknowledgement 1 158 
References 158 



1 Introduction 



Quantum information processing (QIP) is a subject on information processing 
with quantum states[l]. In the recent years, the subject has attracted much 
attention of scientists from various areas. It has been found that in some impor- 
tant cases, quantum information processing can have great advantage to any 
known method in classical information processing. A quantum computer can 
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factorize a large number exponentially more efficiently than the existing clas- 
sical methods do [2]. This means, given a quantum computer, the widely used 
RSA system in classical communication is insecure because one can factorize a 
huge number very effectively by Shor's alhorithm. Interestingly, quantum key 
distribution (QKD) can help two remote parties share a random binary string 
which is in principle unknown to any third party [3]. Private communication 
based on QKD is proven secure under whatever eavesdropping including quan- 
tum computing. Quantum teleportation can transfer unknown quantum state 
to a remote party without moving the physical system itself [4]. 

In classical information processing, all information are carried by classical bits, 
which are binary digits of either or 1. The physical carrier of a classical bit 
can be any physical quantity that has two different values, e.g., the electri- 
cal potential (positive or negative voltages). These are macroscopic quantities 
which can be manipulated robustly by our existing technology. In quantum 
information processing, we use quantum states to carry either quantum infor- 
mation or classical information. Also, we use quantum entangled states as the 
resource to assist the effective processing of quantum information. In princi- 
ple, lots of different physical systems can be used to generate the requested 
quantum states and quantum entanglement. In those tasks related to com- 
munication, light seems to be the best candidate for the physical system to 
carry the quantum information and/or the quantum entanglement due to its 
obvious advantage that it can be transmitted over a long distance efficiently 
Therefore one may naturally consider to use a single-photon state as a quan- 
tum bit (qubit) and a two-photon entangled state as the entanglement resource 
to assist the processing. 

Towards the final goal of real-life application of quantum information process- 
ing, a very important question in concern is how robustly we can manipulate 
the quantum states involved. In practice, preparing the single-photon states or 
two-photon entangled states deterministically are technically difficult. What 
can be prepared and manipulated easily is a Gaussian state, e.g., a coherent 
state [5,6] (the state of light pulses from a traditional Laser) or a squeezed vac- 
uum state[6,7,8,9,10,ll] of one mode or two modes. Mathematically, a state 
is Gaussian if its distribution function in phase space or its density operator 
in Fock space is in the Gaussian form. (We shall go into details of the phase 
space and Fock space later in this chapter and also other chapters.) Gaussian 
states have proven to be a type of important robust states which have been 
extensively applied for various QIP tasks in labs. Actually, so far almost all 
those important experiments of quantum information are done with Gaussian 
light. 

There are two types of application of Gaussian states in practical QIP. One 
is to use weak Gaussian light as approximate qubits or two-photon entangled 
states. The other is to use strong Gaussian light for continuous variable QIP. In 
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applying the weak Gaussian light, one can regard weak coherent light [5] as ap- 
proximate single-photon source and regard 2-mode entangled weak Gaussian 
light as probabilistic 2-photon entanglement resource in polarization space. 
Weak Gaussian states have been used in many experiments such as the quan- 
tum teleportation with spontaneous parametric down conversion (SPDC)[12] 
and quantum cryptography with weak coherent states or SPDC[13]. How- 
ever, sometimes the higher order terms, i.e., the multi-photon states in the 
single-mode Gaussian light or the multi-pair states in the two-mode Gaussian 
light take a very important role even though the Gaussian light in applica- 
tion is weak. For example, in QKD with weak coherent states, the final key 
can actually be totally insecure if we ignore the role of multi-photon pulses. 
For another example, in quantum-entanglement based experiments such as 
quantum teleportation with SPDC, it is possible that actually there is no en- 
tanglement and the result is a post-selection result if we don't consider the 
detailed properties of the weak Gaussian states. We shall review these types of 
effects and possible ways to overcome the drawbacks. One can also use strong 
Gaussian light to obtain the analog QIP results of discrete states for contin- 
uous variable states. One important advantage here is that strong Gaussian 
light can be used as a resource of deterministic quantum entanglement there- 
fore the results are deterministic and non-post-selection. This is quite different 
from QIP using weak Gaussian states where the results are often probabilistic 
and post- select ion. We shall review the main theoretical results of continu- 
ous variable QIP with strong Gaussian light including quantum teleportation, 
cloning, error correction and QKD using a strong Gaussing light. We shall also 
review the quantum entanglement properties of multi-mode Gaussian states, 
quantum channel capacity and quantum state estimation of Gaussian states. 

This review is arranged as follows: In the remaining part of this section, we 
present the elements of QIP and Gaussian states, including an overview of 
quantum information with qubits and two-photon maximal entangled states, 
mathematic foundation and definition of Gaussian states and properties of 
a beam-splitter as an elementary QIP device. In section 2, we review the 
entanglement-based quantum tasks with Gaussian states, which seem to be a 
very hot topic in the recent years. The section includes quantum teleportation, 
quantum error correction, quantum cloning and non-post-selection quantum 
tasks with weak Gaussian states. We then go into the most important appli- 
cation of QIP, practical quantum key distribution in section 3 and section 4. 
Section 3 introduces the elements and technology background of QKD with 
weak coherent light, section 4 reviews the protocols and security proofs of 
QKD with weak and strong Gaussian light. We then change our direction 
to the mathematical theory of QIP with Gaussian states in section 5 and 6. 
Section 5 is on quantum entanglement of Gaussian states, which have been 
extensively studied these years. Section 6 is on the properties of quantum 
Gaussian channel, which is assumed to be a fundamental subject in quantum 
communication. The theory of quantum state estimation of Gaussian states is 
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reviewed in section 7. This review does not include quantum computation. 



1.1 Elements of quantum information with 2-level states 



A qubit is simply a physical system that carries a two-level quantum state. 
For example, a photon can be regarded as a qubit in polarization space or any 
other two dimensional space. In general, we have the following mathematical 
form for the state of a qubit 

\^) = a\0) + [3\l) (1) 

and \a\ 2 + \/3\ 2 = 1. Here |0) and |1) are orthonormal states of any two-level 
system. Mathematically, one can use the following representation 



|o> = W ;|1>= UJ" (2) 

Consequently, we can use matrices as representations of operations to a qubit. 
In particular, the unity matrix / represents for doing nothing, matrix o~ x = 



1 (10 

for a bit-flip operation, a z = \ \ for a phase-flip operation and 

10 I -1 



i 
-i 



for both bit-flip and phase-flip. 



If we use the photon polarization, notations |0), |1) represent the horizontal 
polarization and the vertical polarization (polarization of angle vr/2) respec- 
tively. One can replace them with more vivid notations of \H), \ V). For exam- 
ple, state cos 6\H) + sin^y) is the state of polarization angle 6. In the above 
equation, \ip) is linearly superposed by |0) and |1). The quantum linear su- 
perposition is different from the classical probabilistic mixture. For example, 
consider the polarizations of 7r/4 and 37r/4. They are the linear superposition 
states of |±) = -^(\H) ± |V)). Given state |+), i.e., polarization of 7r/4, if 
we measure it in the \H), \ V) basis, we have equal probability to obtain an 
outcome of either \H) or \V). This is due to the fact 

l<tf|+>| 2 = l(^l+>| 2 = l/2. (3) 

However, the state |+), i.e., the polarization of n/4 is different from a mixed 
state which is in a classical mixture of horizontal and vertical polarizations, 
with equal probability. Such a classical mixture can be realized in this way: 
Source A only emits photons of horizontal polarization and source B only 
emits photons of vertical polarization. In a remote place we receive photons 
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from both sources. But we don't know which photon is from which source. Our 
only knowledge is that any photon has equal probability from A or B. In such 
a case, any individual photon is in a classical mixture of state \H) and \ V). If 
we measure such a mixed state in {\H), \V)} basis, the measurement outcome 
is identical to that of a pure state of tt/4 polarization. However, if we use a 7r/4 
polarizer, the outcome will be different: the pure state of ir/4 polarization will 
always transmit the polarizer while the mixed state only has half a probability 
to transmit the polarizer. These can be interpreted mathematically by Eq.(3) 
and the following equation : 

l(+l+)| 2 = l- (4) 

Eq.(3) shows that both \H) and \V) have half a probability to transmit the 
it/ 4— polarizer. This means, any classical mixture of \H) and \V) will always 
only have half a probability to pass through the 7r/4— polarizers. To have a 
universal mathematical picture for both pure states and mixed states, we can 
use density operator which reflects the classical probability distribution over 
different quantum states. Suppose a certain source consists of n sub-sources. 
Any sub-source i will only produce the pure state j^). Whenever the source 
emits a photon, the probability that the photon being emitted from sub-source 
% is Pi (pi + P2 + • • -Pn — !)• The state of any photon from such a source can 
be described by the density operator X^Pil^iX^I- A density operator can be 
represented by a matrix which is called as density matrix. The density matrix 
for pure state — a\0) + /3\1) is 





mi>\ = i i («*,/?*)= i 1 1 „ i ■ (5) 

Given any pure state \ip), there is always a unitary matrix U satisfying 

w = m- (6) 

This is to say, we can use the following criterion for a pure state = 
E/|0)(0|£/T: Given a density matrix M, if it is for a pure state, there exists a 
unitary matrix U so that 

UMU ] = | L V I . (7) 




Besides qubits, quantum entanglement is often needed in non-trivial QIP 
tasks, such as quantum teleportation[4]. We shall consider the most well- 
known case of two-photon maximally entangled state in the polarization space. 
Consider the state for spatially separated two photons, A and B. We have 4 



7 



orthogonal states to span the polarization space of the two-photon system: 



l^> = ^=(\H)a\H) b ± \V) A \V) B ); |^> = ±={\H)a\V) b ± \V) A \H) B ). 

All these 4 states are maximally entangled and we shall call any of them as 
an EPR (pair) state named after Eistein-Podolsky-Rosen[14], or a Bell state. 
We shall also call the measurement basis of these 4 EPR states Bell basis. 
We use \<j) + ) to demonstrate the non-trivial properties of an EPR pair. For 
the pair state \<f) + ), the polarization of photon A and photon B are corre- 
lated: if we measure each of them in {\H), \ V)} basis, we always obtain the 
same polarization outcome for two photons. However, this alone does not 
show any non-trivial property of quantum entanglement. Because a certain 
classical correlation can also produce the same result. Consider a mixed state 
p c = l[(\H)(H\) A ®(\H)(H\) B +(\V)(V\)A®(\V)(V\) B }.This state also always 
produces the same polarization for two photons, if each photon is measured 
in {\H), \ V)} basis. One can easily imagine a physical realization of such a 
state: a source always produces two horizontally polarized photons flying in 
different directions (photon pairs). However, whenever there is an emission, 
with half probability we do nothing to the two photons and with half proba- 
bility we rotate both of them by tt/2. In a remote place, it is unknown which 
pair is rotated which pair is not. Then any pair is just in a state with clas- 
sical correlation as stated above. However, an EPR pair has something more 
than this. Given state if each photon is measured in {|±)} basis, we 

shall still always find the same polarization correlation for two photons in the 
measurement outcome: either both of them are |+) or both of them are | — ), 
for 

I0 + ) = ^(I+)a|+)b + |-)a|-M. (8) 

However, given the state with classical correlation, p c , there is no correlation 
between two photons if we measure each of them in {|±)} basis. As one may 
easily check it mathematically: 

(+ + \p c \ ++) = ("- \Pc\ "-) = (+- \Pc\ + ") = (- + \pc\ -+) = 1/4. (9) 

Here we have omitted the subscripts for photon A and B. 

In the entanglement-assisted QIP tasks, we often need a Bell measurement, 
i.e., a collective measurement in the basis of 4 EPR states. As shall be shown, 
the Bell measurement to a photon pair can be partially done by the currently 
existing technology through a beam-splitter. 

We often need two elementary ingredients in QIP with two-level states: a qubit 
state and an EPR state. Give these resources, we can carry out a number of 
non-trivial tasks. As noted earlier, in practice, a perfect single photon source 
for qubits and a perfect entangled-pair source are difficult techniques. Actually, 
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in almost all existing QIP experiments, these difficult sources are replaced by 
weak or strong Gaussian states. The goal of this review is to present the main 
results of QIP with weak and strong Gaussian states. 



1.2 Phase space representation and definition of Gaussian states 



To clearly define the Gaussian states, we shall use the phase space[15, 16, 17,18]. 
We first take a look at some elementary properties of the Fock space[15, 16, 17,18] 
Consider the single-mode field. We have photon-number operator, N. Any 
Fock state |/) is an eigen-state of photon-number operator, i.e., N\l) = l\l). 
When we say that a light pulse is in state |Z), we mean there are I photons 
in that pulse. Also, we have creation operator a) and annihilation operator a 
and N = a^a, i.e. 

a)a\l) = l\l). (10) 
Moreover, a\a satisfy the following equations, 



a)\i) = VTTi\i + i) (11; 



and 



a\l) = Vl\l - 1). (12) 
with a\0) = 0. The operator a) and a don't commute and 

[a, a'] = aa) — a) a = 1. (13) 

A detailed derivation of the mathematical structure of this Fock space from 
classical electrodynamics can be found in, e.g. [15, 16, 17,18]. With eq.(ll), it's 
easy to see that mathematically any photon number state \l) can be generated 
from the vacuum by 

10 = ^|0). (14) 
Moreover, an arbitrary pure state in Fock space can be written in the form 

lx) = /(« t )|0), (15) 

where f(o)) is a functional of a) . For example, for state :~/g(|0) + |1) + |2)), we 
just set f(at) = 775(1 + oJ + 7^) to rewrite it in the form of eq.(15). 

Straightforwardly, one can extend the above one-mode Fock space to the multi- 
mode Fock space. Radiation field can be decomposed into different radiation 
modes characterized by the wave number vector and polarization [15, 16, 17,18]. 
Let Xk and pk denote the 'position' and 'momentum' operators associated with 
the kth mode, respectively (k = 1,2, ■•• , n). These operators or canonical 
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variables are written in terms of the creation and annihilation operators of 
the mode; 



and 



- (a* + 4) 



2u k 




Pk = y (a* -4) > 

where u>fc denotes the energy of quanta of the fcth mode (h — 1). Since [aj, a k ] = 
[aj, 4] = and [a,j, 4] = <5jfc) we have [xj, Xk] = \pj,Pk] — and [xj,pk\ = iSj^. 

Defining R = (R 1 R 2 ,---,R 2n ) T = (^l /2 Xi, ^ 1/2 pi, • • • , ^l /2 x ni uJ~ 1/2 p n ) T , 
these canonical commutation relations (CCRs) can be written compactly as 
[Rj,Rk] = iJjk- Here, J = ©™ =1 Ji with 



For convenience, we shall assume Uk = 1 unless specifically noticed. Most 
generally, the density operator of a state in Fock space can be written in a 
functional form of creation and annihilation operators. But we don't have to 
always use this operator format because a density operator can be represented 
by a (quasi) distribution function in phase space. The phase space representa- 
tion can often simplify the calculations. Actually, the so called Gaussian state 
can be easily defined as a state whose distribution function in phase space is 
in the Gaussian form. 

An n— mode density operator p is defined on the phase space that is a 2n- 

dimensional real vector space. The characteristic function is[15, 16, 17,18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 

X (0 = Tr[pW(0]- (16) 

Here, = exp(^ T i?) is called Weyl operator [15,16,19,20,21,22,23,24,25,26,27,28]. 

The density operator of any quantum state in Fock space can always be written 
in terms of its characteristic function and Weyl operators as follows 



(2k) 

A Gaussian state is defined as such a state that its characteristic 
function is Gaussian: 



X(0 = exp 



(17) 



Here, 7 > is a real symmetric matrix and g e M? n . As shown below, the 
quantum vacuum state, coherent states, squeezed states, and thermal states 
are typical Gaussian states and they constitute an important class of states in 
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quantum optics. In the picture of distribution function, an n-mode Gaussian 
state is characterized by the 2n-dimensional covariance matrix 7 and the 
2n-dimensional displacement vector d. On the grounds of those, much work 
has been reported on Gaussian states, in particular, in quantum information 
theory/experiment. 

The first moment is just the displacement given by dj = Tr(pRj) and the 
second moment is given by 

j jk = 2Tr[p(Rj - dj)(R k - d k )] - iJ jk , (18) 

which is called covariance of canonical variables. The real symmetric matrix 
(jjk) is called the covariance matrix 7. Note that due to our choice of canonical 
variables, R 2 j-i = &j and R 2 j = uo~ l ^ 2 pj (j = 1, 2, • • • , n), the trace of the 
principal sub-matrix of the jth mode of 7, 



7b1 



72j-l,2j-l 72j-l,2j 
V 72j,2j-l 72j,2j 

gives the energy of the jth mode if d 2 j-i = d 2 j = 0; 

1 , , // + \ 1 



-^k (T2i-l,2j-l + l2j,2j) = (^(«j a J 



2 



A density operator p is a positive (semi-)definite operator (p > 0) with Trp = 
1. If p ^ 0, it does not describe a physical state. The condition for a physical 
Gaussian state is given in terms of the covariance matrix as follows [19,29]. 

Theorem 1.- Matrix 7 is the covariance matrix of a physical state if and only 
if 7 + i J > 0. A Gaussian state is pure if and only if det 7 = 1. 

From this theorem, it can be shown that dim[Ker(7 + ij)] = | dimX. Here, 
X denotes the phase space. 

Theorem 2.- If the characteristic function of a bipartite state density operator 
Pab is Xab(0 = Xab{£a,£b) with £ T = (£l,6l)> th e characteristic function 
for the density operator in subspace B is Xb(£b) = Xab(£a = 0,£_b)- 

The proof is very simple: Since Pb = Tr^p^^, the characteristic function in 
subspace B is 

Xb = TT B (p B e^ R -) = Tr( PAB e*» R *) = Tr(p AB e^ R * + ^ R -)\ u=0 
which is just Xab(0,£b)- 
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Linear transformation is rather useful in calculating the Gaussian character- 
istic functions. A linear transformation on canonical variables is written as 
R — > R' = MR. Since the new variables R' also must conserve the CCR 
[R'j,R' k ] = iJjki MJM T = J must hold. Such a linear transformation pre- 
serving the CCR is called canonical transformation and a 2n x 2n real matrix 
satisfying MJM T = J is called symplectic matrix, M G Sp(2n,M.). The in- 
verse of M is given by M~ l = JM T J~ x . If M is Symplectic, M~ l and M T 
are also symplectic and detM = 1 [30]. One of the most important properties 
of symplectic matrices is the following Williamson's theorem [31]. 

For a real symmetric positive-definite 2n x 2n matrix A = A T > 0, there exists 

a symplectic matrix M e Sp(2n, R) such that MAM T = diag(«i, «2> K 2> • " * > K n K n) 

with Ki > (i — 1, 2, ■ ■ ■ , n). 

A linear canonical transformation corresponds to a unitary transformation in 
the Hilbert space. Such a unitary transformation is defined by 

S ] M4l RS M4 ,=MR + d' 

and d! is a 2m-dimensional real vector. Consequently, S M d ,W(^)SM,d' = VV(M^) exp(i£ T d') 
and the density operator is changed to p — SM,d'pS M d ,. Suppose p is a Gaus- 
sian state with covariance matrix 7 and displacement d. Omitting the sub- 
scripts of S]M,d>, we can formula the characteristic function of the new state 
p = SpS^ as follows 



Tr[Sp£fiW(£)] = Tr\p£fiW(£)S\ = Tr[pexp(^ T 5 t J R5)] 

1 



exp 



■^ T M 7 M T ^ + if(d' + Md) 



exp 



(19) 



and 7 = M7M 71 and d = d' + Md. Therefore we conclude 

Theorem 3: Suppose the covariance matrix is 7 and the displacement vector 
is d for density operator p. The characteristic function for density operator 
p = SpS^ must be exp (-^ T 7^ + i£ T d) with 7 = M 7 M T and d = d' + Md, 
if the unitary operator S satisfies S^RS = MR + d'. 

The linear transforms can be implemented by optical elements such as beam 
splitters, phase shifters, and squeezers. For example, a (phase-free) beam split- 
ter transforms the field operators a\ and 02 as follows. 




cos 9 sin 9 
— sin 9 cos 9 
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Thus the corresponding symplectic matrix takes the form 

/ „„ r , a n a n \ 



M, 



Us 



cos 9 





sin# 





cos# 





— sin 9 





cos# 





— sin 9 






(20) 



Given that the transmission rate and reflection rate of the beam splitter are 
given by T = cos 2 9 and R = sin 2 9, respectively. The (single mode) squeezer 
with squeezing parameter r transforms the field operator a into a cosh r + 
sinh r and the corresponding symplectic matrix S sq takes the form 



M, 



sq 



diag(e~ 



(21) 



Besides the characteristic function, there are other forms of distribution func- 
tions which can also represent the quantum states. One of them is the famous 
Winger function. The Wigner function is defined as the symplectic Fourier 
transform of characteristic function, 



w(0 



(2vr 



J— J d 2n V e-^ X (v)dv. 



(22) 



For a Gaussian state, its Wigner function is also a Gaussian function. After 
performing the Gaussian integration, we obtain 



7r"Vdet 7 



exp 



■tt-<0V(f-d) 



Here, 7 _1 is the Wigner correlation matrix. Therefore the Wigner correla- 
tion matrix of p = SpS* 1 is M~ 1 7~ 1 (M T ) _1 , if 7 _1 is the correlation matrix 
of p and S^RS = MR. The Wigner function is similar to a classical probabil- 
ity distribution in position-momentum. For example, consider the one-mode 
Wigner function and denote £i — x, £ 2 = P, 



W(x,p)dxdp 



(23) 



and JW(x,p)dx, J W(x,p)dp are for the classical probability distributions 
over momentum space (variant p) and position space (variant q), respectively. 

An n— mode density operator p can be formally expressed as the diagonal form 
with respect to the n mode coherent state a 2 , • • • , a n ) = ®^ =1 \aik) as 



r n 

P = / II d 2 a k P(a 1 , a 2 , ■ ■ ■ , a n ) \a x , a 2 , • ■ ■ , a n ) a 2 , 

J k=i 



(24) 
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This expression is called the P representation of the density operator p, and 
P(oii, «2, • • • , cx. n ) is called the P function. Such a representation exists for any 
density operator provided that the P function is permitted to be singular [6]. 
In Eq. (24), 



1 , „\ ^ K) J 



a k ) = exp ( -- \a k \ ) J2 ^yjf \j) 



(25) 



with \j) = (i!) _1/2 (4) j |0>, and d 2 a = dReadlma. The coherent state [Eq. (25)] 
is an eigenstate of a k ; 



a k \oik) = ak \a>k) 
and satisfies the completeness relation, 



(26) 



fd 2 a 
/ \a) {a\ = 1. 

J 7T 



(27) 



The P function is written as 



1 r n ( n \ 

P{a u a 2 , ■ ■ ■ , a n ) = — / Y[ d 2 Vk exp a kVk ~ a kVk Xn{Vi,V2, ■ ■ • , Vn)- 
71 J k=i \k=i J 

(28) 

Here, 



Xn(Vi,V2,--- ,Vn) = Tr 



pexp [J2 Vka{ exp ( - J2 vt^k 



\k=l 



k=l 



is the normally ordered characteristic function. The normally ordered charac- 
teristic function is also written as 



XN(r)i,V2, ■ ■• ,Vn) =Tr 



p ex p X! w4 - vi^k 



<k=l 



exp ( \j2\Vj\ 



(29) 



Here, if we write £2*1-1 = v^2Re?7fc and £2/0 = — V^Imr/fc (k = 1,2, ■■• , n), 
Efc=i(%4 - 7]* k a k ) = Efc=i(-*6*^fc + i&k-iPk) = ii T JR ■ This shows that 
Tr[---] in the right-hand side of Eq. (29) is nothing but the characteristic 
function. The P function can be thus written in terms of the characteristic 
function. 



Here, we derive the trace formula of Weyl operator, which is used in Sec. 5.2.2. 
Using Eqs. (26) and (27), we have 
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k=l 

'1 



W(0 = II ex P (^4 - V* k a k ] 

k=l 

II exp 0- |%| 2 ] exp (-rf k a k ) exp (^4) 



fc=i 



-VkY (jjk) r | w I f* 



ft exp gkl 2 )/ 



7T 



a fc ) (a fe | exp (^c^ - rf k a k ) . 



Therefore, 



W(0=flexp (%| 2 ) /^exp 

fc=l V2 / J 7T 



Since 



we have 



f — — exp (rja* — t]*a) = 7i5(Rer])5(lmri), 

J IX 

TrW(0 = (2n) n 5(0. 



(30) 



1.3 Coherent states 



Lets start from the simplest state, the vacuum, i.e., the density operator |0) (0|. 
According to the definition, the characteristic function is 

oo 

= Tre^ l£+6?5) |0)(0| = ^(n|e^ l£+?2?5) |0) (0|n|) = (0|e^ lS+ ^|0). 



Given that x — 775 + a) and p = -j^(a) — a), we have 



Here we have used the following well known operator identity[5,6] 



exp(f2i + fi 2 ) = exp(— - [Jli, f2 2 ]) exp fix exp Q 2 



(31) 



(32) 



if [Sli, [fii,0 2 ]] = [ft 2 , [fii,fi 2 ]] = 0[6]. Putting this back into Eq.(31) we im- 
mediately obtain the following explicit formula for the characteristic function 
of vacuum 



x(£i,6)=exp[-(tf + £)/4]=exp 



-|(6,6)7o 



6 

e 2 



(33) 
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Therefore, the characteristic function of vacuum state is indeed in the Gaus- 
sian form and the covariance matrix 70 here is simply a 2 x 2 unity matrix. 
Based on this fact, through linear transformations, one can easily write out 
the characteristic function of a coherent state [5], the characteristic function a 
squeezed (vacuum) state, and many other Gaussin states. The state of a light 
beam out of a laser device is coherent state[5]. (For a systematic study of co- 
herent states and squeezed states, one may go into more specific reviews, such 
as[6,8,9,10] or quantum optics textbooks, e.g. [8,15,16,17,18].) The following 
well known Baker- Campbell-Hausdorff (BCH) formula is particularly useful 
in studying the linear transformations: 

e'Ve-" = u + [/x, u\ + I [/i, \pt, u\\ + | [/x, »}}} + ■■■ (34) 

Here /1 and v are two arbitrary operators and v\ = fiu — ufi. A displacement 
operator is defined as 

D(d Xj d p ) = exp(id p x — id x p) = exp[(<W — a*a)/V2] = V(a/V2) (35) 

and d x , d p are real numbers satisfying d x + id p = a. Using Eq.(34) we can 
easily obtain 

T>\a)(a\ a)V(a) = (a^+a*, a+a); D ji (d x ,d p )(x,p)D(d x ,d p ) = (x+d x ,p+d p ). 

(36) 

The coherent state 

00 n 

l«) = e"H 2 / 2 E^H- (37) 
n=o v n\ 

is equivalent to 

| a ) = e o*t_|ap/2 1 0) =V(a)\ 0). (38) 
Here we have used the the operator identity of Eq.(32) and fact |0) = e a * a |0). 

The coherent states is a member of Gaussian states. Since the coherent state 
\a) can be regarded as the displaced vacuum of T>(a)\0), according to theorem 
3 its characteristic function is simply 



X(£i>6) = exp 



(39) 



based on the characteristic function of vacuum state in Eq.(33). This is a 
Gaussian function. 



Coherent states are a type of minimum uncertainty states for quadrature op- 
erator x, p. Since x and p don't commute, the following uncertainty relation 
must be respected given any state: 

«x 2 > - (x) 2 ) ■ ((p 2 ) - (p) 2 ) > \[x,p]/2\ 2 = 1/4. (40) 
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Q2 




Fig. 1. Any coherent state \a) can be represented by an error circle with radius of 
1/2 and a displacement q± = \^2Re(a) and q2 = V^Imo;. 

Here we have used the fact 

[x,p]=i. (41) 

The commutation relation of quadrature operators x, p is the same with that 
of position operator and momentum operator in quantum mechanics, we also 
call operators x,p as "position operator" or "momentum operator" for con- 
venience. According to Eq.(39), the covariance matrix of any coherent state 
is a unity matrix which indicates ((x — (x)) 2 ) = ((p — (p)) 2 ) = 1/2. This is 
equivalent to ((x 2 ) — (x) 2 ) ■ {(p 2 ) — (p) 2 ) = 1/4 which is the minimum value 
as requested by the uncertain principle. 

Intuitively, the coherent state |a) can be represented by a displaced error circle 
as shown in fig.(l). 

The averaged photon number of coherent state \a) is 

/i = (a|cr a|o:) = \a\ 2 . (42) 

This is the intensity of coherent state \a). A coherent state can also be char- 
acterized by its intensity and phase, i.e., a coherent state with intensity /x and 
phase 9 is 

|^,0) = eVP^-A^o) (43) 

with (j, — \a\ 2 and e ld = a/\a\. Doing Taylor expansion to operator e Qat and 
using the property of a)\n) = l\n + 1) we have the following linear 

superposition form for the coherent state in photon-number space: 

oo n/2 p ind 

n=o Vnl 
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The phase 6 of light pulse from an ordinary laser device is random. If the phase 
is random, a coherent state with intensity /i is actually a classical mixture with 
Poissonian distribution of photon number states: 



1 r 27T n n 

p, = tt M><MI = e-*E*TMH ( 45 ) 

2,71 Jo n n - 

If fi is small, a light pulse in the state above is almost the same with a single- 
photon pulse if it is not vacuum. Therefore the weak coherent light is often 
regarded as the approximate single-photon light. All properties of a coherent 
state can be simulated by a classical Gaussian light. Therefore a coherent 
state is regarded as a classical state. Also, any classical probabilistic mixture 
of different coherent states is also a classical state, i.e., state 

j P(a)\a)(a\d 2 a (46) 

is classical if P(a) is positive-definite. 

1.4 Squeezed states 

Besides coherent states, a more general class of minimum-uncertainty states 
are known as the squeezed states. In general, squeezed states may have less 
uncertainty in one quadrature than that of coherent states. Due to the re- 
quirement of the uncertainty principle, the noise in the other quadrature of a 
squeezed state must be larger than that of the coherent states. Most generally, 
a state is called squeezed if its covariance matrix has an eigenvalue smaller 
than one. 

l.^.l One-mode squeezed states 

The simplest single mode squeezed state is the squeezed vacuum state, 

IC,0> = S(C)|0> (47) 
generated by the squeezing operator 

S(C) = exp ^at 2 + ( -a^ , (48) 

from vacuum |0) where £ = rexp(z0) is an arbitrary complex number with 
modulus r and argument 0. The squeezing operator S(() is unitary because 
S't(C) = exp (^a) 2 — Y a2 ) = | S ,_1 (C) is the inverse of operator S{Q. 
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The squeezed vacuum state is a minimum-uncertainty state with the variance 
of two quadratures being different. To show this, we calculate the variance 
of quadrature operators x, p . The BCH formula of Eq. (34) gives rise to the 
following transformation 



and 



M, 



S- 1 (C)(a\a) T S(0=M ( (a\af 

( 
\ 



(49) 



(50) 



(51) 



coshr — e ^sinhr 
— e^sinhr coshr 
and it's inverse transformation is 

S{Q{a\a) T S-\Q = Ml\a\af. 

Here 

(a' , a) T = 

The transformation in x, p space is 

S-\x, p) T S = S" 1 ^, a)K} T S = [{a\ a)M c K] T = M c (x, p) T (52) 

with 




and K = 73 




M c = K~ 1 MqK 
. In the special case that C, is real, 



(53) 




(54) 



This is just Eq.(21). According to theorem 3, the covariance matrix of the 
squeezed vacuum state 5'(C)|0)(0|S' _1 is simply 







( e~ 2r \ 


(■::)- 




[ e 2r ) 




{ e'j 



(55) 



Such a covariance matrix indicates that the variance of position and momen- 
tum are e~ 2r and e 2r respectively, while the product of these two variance keeps 
to be the minimum uncertainty. The position (momentum) noise is "squeezed" 
if r is positive (negative). Most generally, ( is a complex number and the 
maximum squeezing is for the observable of rotated position. This minimum- 
uncertainty relation actually holds for the squeezed vacuum state with any 
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Fig. 2. Comparison of the variance shape of a squeezed vacuum state and vacuum, 
a displaced squeezed vacuum state and a coherent state. 1: Error circle of vacuum; 
2: Error ellipse of a squeezed vacuum; 3: error circle of a coherent state (displaced 
vacuum); 4: error ellipse of a displaced squeezed vacuum state. 

complex parameter £. Moreover, since a displacement does not change the 
variance, this minimum-uncertainty relation and the squeezed variance of x 
are also true for an arbitrary displaced squeezed vacuum state V(a)S(Q\0). 
Pictorially, one can draw the variance ellipse for a displaced squeezed state as 
shown by fig. 2. 

The squeezing operator can be normally ordered as[17]: 



s(0 



cosh|C| 



x exp 



— e*tanh|fl 



cxp 



-cr a(ln cosh |£|) 



cxp 



This leads to 



s(C)\o) 



V cosh \ 



exp 



1 2 

—w e i<?i tanhr 



-a 2 e^tanh|C| 



|0> 



(56) 



(57) 



given the fact a\0) = 0. Furthermore, by taking Taylor expansion to the ex- 
ponential operator and using eq.(14) we have 



15(010) = VsechrJ2 



n=0 



??! 



— e^tanhr 
2 



|2n). 



(5* 



From this equation, we see that state |C ; 0) is actually a linear superposition 
of even photon number states. 
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Different squeezed vacuum states are not orthogonal. By the transformation 
property, overlap between two squeezed states can be easily calculated [8]. 



(C,o|c / ,o) = (o|st(c)S(0|o). 

It can be simplified with the normally ordered form of Eq.(56) as 

(COK',0) 



(59) 



V sechrsechr'(0| exp 



— a e 
2 



'tanhr 



exp 



■-a t2 e^' tanhr' 
2 



|0> (60) 



One can transform the product operator between the two vacuum states in 
the above equation into the normally ordered form[17,32,33,34] and obtain the 
overlap of two squeezed states [9] 



(C,o|C',o) 



sechrsechr' 



1 — e 1 ^' tanh r tanh \ 



(61) 



1.4-2 Two-mode squeezed states 



The two-mode squeezed states [20] are especially useful in QIP, because they 
can be used as entanglement resource. Mathematically, similar to the one- 
mode squeezed state, a two-mode squeezed state can be generated from the 
vacuum by a two-mode squeezing operator, 



S = exp (— C a i a 2 + C a i a 2 



(62) 



where a\ and a 2 (ai and 02) are the photon creation (annihilation) operator 
of each mode. Operators of different modes commute. 

The two mode squeezing operator has the following transformation property: 



S 1 (a{, ai, g4, a 2 ) T S = M^(a\, a l5 a\, 02) 



(63) 



and 



Mr 



(64) 



Here r = |£| and re 1 ^ 
momentum space is 



cosh r e~ 1 ^ sinh r ^ 

cosh r e 1 ^ sinh r 

e~ % ^ sinh r cosh r 
e^sinhr coshr 

£ . If r is real, this transformation in the position- 



/ 



S 1 (xi,x 2 ,pi,p 2 ) T S = L(x 1 ,x 2 ,pi,p 2 ) rj 



(65) 



21 



and 



L = #diag(e- r ,e r ,e r ',e- r )# T , H = ^ 



( 1 -1 ^ 
10 1 
10-1 
10 1 



This means that 



S\x\ — x 2 )S = e~ r (xi — x 2 ) and S^(pi +p 2 )S' = e _r (pi + p 2 ), i.e., both fx — x 2 
and p! + p 2 are squeezed. Therefore the covariance matrix for the two-mode 
squeezed state with squeezing factor ( = r is 



lsq2 = H 1 di ag (e- 2r ,e 2r ,e 2r ,e- 2r )H. 



(66) 



The formula above gives rise to the following formula for the characteristic 
function of two-mode squeezed state 



X*j2(fi,f2,f3,f4) = exp 



" - m2 i /t ,t \2l e [Yd- i t 



■[(6 - &r + (6 + &)i - + &r + (6 - &) 

(67) 



The two mode squeezing operator can also be written in the normally ordered 
form[17,32] 



S(C) 



cosh ICI 



exp 



x exp 



a\ai + a 2 a 2 ) ln(cosh \(\) 



■ exp 



"aiWe^tanhlCl 
e -^tanh|C|aia 2 



{6i 



With this normally ordered form, the two-mode squeezed vacuum state can 
be simplified: 



>S(C)|00) = sechr ^ [exp(i0) tanhr]™ |n)i|n) 2 

n=0 



(69) 



The state of each individual mode in the two-mode squeezed state is a mixed 
state. The density operator of each mode can be calculated by taking the 
partial trace of the whole state. For example, the state for mode 1 is 



Pi = tr 2 |C,0)(C,0| = sechV ^ tanh 2n r\n)(n\. 



n=0 



This is just a thermal state of 

p th {(3) = (1-e^) exp(-Mi) 



(70) 



(71) 



and (3 = — lntanh r. According to our theorem 2, the characteristic function 
of the thermal state above can be easily deduced from Eq. (67) 

1 



Xth,p(€i,£2)(P) = exp 



(72) 
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and v = cosh2r. This means that the characteristic function in the above 
form is for a thermal state Pthifi) with 



e~ P = V -^t- (73) 



The wave-function of a two-mode squeezed state in position space is[l 1] is 



iS'(C) ] 00) = —= [ dxidx 2 exp 
V 71 " J 



e 2r e~ 2r 
■ — (xi - x 2 ) 2 ( x i + x i) 2 



(74) 



The same state in the momentum representation is 

Jlr „-2r 



1 



dpidp2 exp 



(75) 



Therefore, in the limit that r — > oo, the two-mode squeezed state has the 
following un-normalized form: 

x) 1 \x) 2 dx = J -p) 2 dp. (76) 

From this we can also see clearly the squeezing properties for a two-mode 
squeezed state in the extreme case: It is a simultaneous eigen-state of both 
(xi — x 2 ) and (pi +p 2 ) with both eigenvalues being 0. We shall call this type of 
entangled state as the EPR state or Bell state in position-momentum space. 
We shall call the simultaneous measurement of (xj — x 2 ) and (pi + f> 2 ) Bell 
measurement in position-momentum space. Most generally, the simultaneous 
eigen-state of X\ — x 2 and p\ + p 2 with eigenvalues A and E is a displaced 
two-mode squeezed state of 

oo 

\B(A, E)) = J D(A,E)exp[r(a t 1 4-aia 2 )]|00) = D(A, E)sechr ^ ^ k \kk) (77) 

fc=0 

and r — >• oo. Here D(A, E) is defined in Eq.(35) and 7 = tanhr — > 1, and we 
have used Eq.(69). 

Remark The continuous variable Bell state implies the infinite squeezing which 
doesn't exist. However, a two-mode squeezed state of finite squeezing is also 
entangled and can be used to carry out non-trivial entanglement-based tasks. 



1.5 Beam-splitter 



Beam-splitters [35,36,37,38,39] are widely used in the quantum information 
processing. A beam-splitter can work as a type of interferometric device, a 
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Fig. 3. A schematic diagram of the beam-splitter. Both the input and the output are 
two mode states. The different mode is distinguished by the propagating direction 
of the field. BS: beam-splitter. 

type of quantum entangler and also a device for Bell measurement. Lets first 
consider the elementary properties of a beam-splitter: the relation between 
the output state and input state of a beam-splitter. For clarity, we use the 
Schrodinger picture[38, 39,40,41] here. We shall define the mode by the prop- 
agation direction, for both input and output states. Consider figure 3. Both 
the input state and output state are two-mode states. Even though we have 
only sent one light beam into the beam-splitter, we shall still regard the total 
input state as a two-mode state by setting the state of another input mode to 
be vacuum. For example, the input light beam of mode 1 contains one photon 
and there is nothing in mode 2, the total input state is |l)i (g) 1 0)2 which is 
simplified by notation |10). The output state is \ip) out = Ub\10) and Ub is the 
time evolution operation caused by the beam-splitter. The specific parameters 
in Ub are determined by the material properties of the beam-splitter itself. 
However, in calculation, normally we don't need the explicit formula of Ub 
itself, we only need the transformation properties of Ub- Given any input of 
pure state, we can always write it in the two-mode form of 

|V)in = /(a!,4)|00). (78) 

After passing the beam-splitter, the state is changed to 

\i>)aut = U B f(a\,at)\00) = U B f{ala\)U B l U B m. (79) 

Considering the fact of no input no output for any beam-splitter, one imme- 
diately finds U B \00) = |00), therefore 

\^)out = U B f{ala\)U B l m = f{U B a\U B \UBa\UB l )m. (80) 
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Denote (a{, ai, 4> «2) T 



4 

Va 2 y 



.Suppose 



U B (a\, ai, 4, a 2 ) T U B 1 = M B (a\, a x , 4, a 2 ) T (81) 

then a beam-splitter is fully characterized by matrix M B , with the output 
state being explicitly given by Eq.(80), given whatever input state. Since any 
time evolution operator must be unitary, matrix M B of any beam-splitter in 
SU(2). Therefore, the most general form of matrix M B is 



' cos6»e^° 



cos 



- sin 9i 

9e -i<Po o 







\ 



sin i 







COS I 



-up 



\ 







sin I 







— sin i 



cos I 



(82) 



In the special case of a 50:50 beam-splitter, 9 = ir/A and 4>o 
matrix is 

( 1 -1 ^ 



0, the 



M B = ,= 



1 

72 



10-1 
10 1 
\0 1 1. 

In the position-momentum space, the transformation formula is 
U B (xi, pi, x 2 , p2) T U B l = M B (xi, pi, x 2 , p2) T 



53) 



/ 



with 



and K 



1 1 



Mb = (K- 1 © K~ l )M B (K © K) 
/ \/2. In the special case that 9 = 7r/4 and 



55) 
0, 



.Mb = Mb, which is given by Eq.(83). 

Summary: To write the output state of a beam-splitter, one only needs to write 
the input state in the form of f(a\, 4)|00) and then replace a\, a\ by U B a[U B l 
and Usa^U^ 1 , respectively. U B a\U B l and Ubc^Ub 1 are determined by eq.(81). 
Matrix M B is determined by the material properties of the beam-splitter itself. 
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1.5.1 Collective measurement in polarization space 

So far we have assumed that the input light beams of each mode have the 
same polarization and frequency. If the two input beams have different po- 
larization or frequency distribution, the result will be different. Beams with 
perpendicular polarizations or different frequencies will have no interference. 
For simplicity, we consider the effects caused by different polarizations here 
only. Since perpendicularly polarized photons don't have quantum interfer- 
ence, the transformation matrix M B only applies to horizontal photons and 
vertical photons separately. That is to say, we shall first write the state of the 
input light in the form of f(a\ H , a\ v , a\ H , al v )\00) and then use 



U B (a iH> a iH,0'2Hi a 2H) T U B — M B (a 1H ,ai H ,a 2H ,a2H) T 

(86) 

a ivi a Wi a 2Vi a 2v) T U B — M B (a lv , aiv, &2Vi a 2v) T 

This is to say, we shall treat H, V as different modes and the operators of 
perpendicular polarizations commute. Here the creation operators of certain 
polarization have the same property with those on a specific mode. For exam- 
ple 

4|0> = \H) = |l>//;4/|0> = V2\2H) = V2\2) H ; 

and so on. Consider the case that each input beam contains one photon, 
the polarization for beam 1 is horizontal and the polarization for beam 2 is 
vertical. The input state is \ip)in — 1-^0 i ® 1^)2 = a iH a 2V 

|00). Given a 50:50 

beam-splitter, the state of the output beams is 

Wont = ~(a\ H + a\ H )(a\ v - 4v)|00). (87) 
This is equivalent to the state 

\iP) 0Ut = \HV) 1 ® |0> 2 - \H) 1 ® \V) 2 + \V) 1 ® \H) 2 - |0>! ® \HV) 2 (88) 

and the state \HV)\ = a\ H a\ v |0), which means mode 1 contains one hori- 
zontally polarized photon and one vertically polarized photon. Given this for- 
malism, we can now show how a 50:50 beam-splitter may assist us to do the 
(incomplete) Bell measurement with single-photon detectors. Suppose each 
input mode contains one and only one photon and we have placed a single- 
photon detector at each side of the beam-splitter to detect the output light 
beam of each mode. We want to see whether the input beams are in the max- 
imally entangled state of \ip~) = ^(l-^)i ® \V)2 — \V)i ® l-^h) by watching 
the single-photon detectors. As we have known already, there are 4 states in 
Bell basis. If we want to know whether the input state is we must be 

able to exclude the other 3 states Q^), l^" 1 "))- The detectors' status caused 
by the output beams of these 3 states must be deterministically different from 
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that of For such a purpose, we consider the consequence of the 4 Bell 

states one by one. Given the input state |^ + ) = ■j%(\H)i<8>\V)2 + \V)i<gi\H)2), 
we can rewrite it into 

= -^(4tf4v + 4y«L)|00). (89) 
After passing through the 50:50 beam-splitter, the state is transformed into 

\^)out = ^[fclff + 4if)(4v ~ 4f) + (4v + <Av){<Ah ~ 4h)]|00>- ( 90 ) 

According to Eq.(80) and Eq.(83), this is equivalent to 

Wiaut = ^(4^-4X^)100) = -L(|fTV)i®|0> 3 -|0)i®|FV) 3 ). (91) 

This shows, if the input state is one mode of the output must be vacuum. 
Thus one detector must be silent. Similarly, given the input states of |0 ) = 
4§(|-H)i ® \H) 2 ±\V)i® | V) 2 ), we find that the output states are ^(|2#)i ® 
1 0) 2 + 1 0) 1 ® \2H) 2 ) ± |2 V ) 1 ® 1 0} 2 ± 1 0) 1 <g) 1 2V) 2) . This also shows that , given the 
input state \<p + ) or \<f>~), one output beam must be vacuum thus one detector 
must be silent. 

But what happens if the input state is ? Given the input of 

Mi» = l^~> = ^(4^4v " 4y4//)|00) (92) 
the output state must be 

\^)out = + 4u)(4v - 4v0 - (4v + a lv)( a iH ~ 4h)]I°°) ( 93 ) 

which is equivalent to 



-^(4h4f-4v4h)|00) = --^ 



)out = -^=(a\ H al v -a\ v al H )\00) = -^-(\H) 1 ®\V) 2 -\V) 1 ®\H) 2 ). (94) 



This is to say, each output beam contains 1 photon. Therefore, if both detectors 
click, the input beams must be in One may go into [41,12] for the historic 
development of collective measurement by a beam-splitter. 

Summary: We can regard two perpendicular polarizations as two modes and 
treat each polarization separately. A 50:50 beam-splitter can help us do an 
incomplete Bell measurement in polarization space. Suppose each input beam 
contains one photon, if both detectors in the output space click, then we judge 
that the input light must have been collapsed into \ip~)- 



27 



1.5.2 Bell measurement in quadrature space through homodyne detection. 

Now we consider the Bell measurement in a type of continuous basis, say, 
in the coordinate basis of the eigenstates of position difference X\ — x 2 and 
momentum sum pi + p 2 - Since the operator x\ — x 2 and p\ + p 2 commute, the 
two measurements can be done simultaneously in principle. To measure these 
two quantities, we only need a 50:50 beam-splitter as shown in figure 3. Given 
the 50:50 beam-splitter as defined by Eq.(83), measuring the momentum of 
the output mode 1' is equivalent to a collective measurement of f>\ + p 2 on the 
input beams and measuring the position of output mode 2' is equivalent to 
the collective measurement of x\ — x 2 on the input beams since the following 
transformation happens in the Heisenberg picture 

Pi' = UbPiUb = ; x 2 ' = U B x 2 U B = . (95) 

Therefore, given a 50:50 beam-splitter, the Bell measurement to two input 
beams is reduced to the local measurements of position and momentum on 
each output modes. The only technical problem remaining now is how to 
measure the coordinate of the output beam 1' and and momentum of beam 
2'. This can be done by the homodyne detection[42, 43, 44,45,46]. 

As shown earlier, the states in Fock space can be represented in the position- 
momentum basis, i.e., the eigen-states of x{6) = -^(a^ e ld +ae~ l9 ) , {\xg)(xg\,xe G 
(—00, +00)}. However, the photon detector itself only projects a state into the 
photon number states. To measure a state in the basis of {|xe)(x6/|} by pho- 
ton detectors, we need a bright classical light beam, which is called as "local 
oscillator". In the measurement, the signal light is "phase locked" to the local 
oscillator. The local oscillator is a coherent state \cx)l and is denoted by "L" 
in Fig. (4). We use the set-up to take quadrature measurement on the signal 
beam, beam S. What is observed is actually the photon number difference of 
two output modes, i.e., 

(AN) = (i) ou t\a} s a s - a ] L a L \%l) out ) = (^(L^ 1 (a j s a s - a[a L ^ U B \i>in)- (96) 

Based on the last equality of the equation above, the photon number difference 
of the two output modes can be equivalently regarded as the measurement out- 
come of U B l (a} s a s — a L aij Ub = a^ai + a) L as on input state \ipi n ), i.e., the 
state of light beams S and L. In this picture we have regarded the beam- 
splitter itself as part of the measurement device. Since the local oscillator is a 
very strong bright light in coherent state (e~' Q ' 2//2+Qa i |0)), operator can be 
replaced by a. Therefore the observed result of the photon number difference 
of the output modes is actually the observation of 

\a\(a<e i6 + ae~ i6 ) = V2\a\x(9) (97) 

to the input mode S, i.e., a measurement to input mode S in the rotated 
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L 

local oscillator 

Fig. 4. Balanced homodyne detection with a 50:50 beam-splitter. By observing the 
current induced by the photon difference of beam 1 and beam 2, one measures signal 
beam, beam S by operator x(9) and 6 is dependent on the state of local oscillator, 
beam L. 

position space. 

Remark: Normally, 9 value is unknown if beam L is from a normal laser de- 
vice. What we have known is that we have observed x(9) and 9 is the phase 
parameter of beam L. This is to say, we don't know the phase value but all 
pulses have the same phase (phase locking). 

As an application, we now demonstrate how to detect the position fluctuation 
squeezing of a squeezed state. Given a single-mode squeezed state 5(C) |0) and 
5(C) = exp(— |al~ 2 + ya 2 ), C = |Cl eJ<? \ we nn d the quadrature fluctuation 

((Ax(9)) 2 } = |[exp(-2|C|) cos 2 (£ - 0/2) + exp(2|C|) sin 2 (# - 0/2)] (98) 

We see that the fluctuation of x will be less than 1/2 provided that \9 — 0/2 1 
is not too large. In the experiment, the squeezed state is always phase-locked 
to the local oscillator. Explicitly, one can produce many copies of input states 
and the local oscillator and the value of and 9 have a fixed relationship, e.g., 
= 20. 

The position squeezing is verified if one finds that the fluctuation of x(9) is 
less than 1/4, i.e., 

(4> - M* < 1/2- (99) 
here xei is the observed value of the ith signal, (yi) is the averaged value of all 
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Fig. 5. Verifying the position fluctuation squeezing. The squeezed state is produced 
after the pump light pass through the cavity (squeezer). 

Hi. The set-up is drawn in fig. (5). Since every squeezed state is phase-locked to 
the local oscillator, we can set (p — 9 to be quite small in the experiment. With 
the observed position values of many copies of squeezed states, the position 
fluctuation can be calculated by Eq.(99). 

Knowing how to measure the position, one can easily know how to do the Bell 
measurement. We demonstrate it by x\ — x 2 - Consider figure 3. Measuring 
the quantity of x\ — x 2 and p\ + p 2 of the light beam 1 and 2 is equivalent 
to measure x and p respectively to beam 1' and 2'. The individual position 
measurement to beam 1' and momentum measurement to beam 2' can be 
done by the homodyne detection as shown already. Suppose the state of beam 
1 and 2 is \ipi n ) and the state of beam V, 2' is Measurement outcome of 
the position of beam V is 



(ij/\x ® = (AuIUb 1 (x (8) 1) U B \i/> in ) = (if} in \ (zi - x 2 ) \i) in ). (100) 



In short, using beam-splitters and strong reference light, one can do the Bell 
measurement in position- momentum space, i.e., one can measure x\ — x 2 and 
Pi + p2 simultaneously. 

Remark: Different from the case of beam-splitter collective measurement in 
the two-photon polarization space, here the Bell measurement in position- 
momentum space is complete, deterministic while the one in two-photon po- 
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larization space is incomplete (can only judge whether the state is \ip~)), 
non-deterministic and normally with post selection only This is an important 
advantage of Gaussian states in QIP. 



1.6 Beam-splitter as an entangler 

A beam-splitter can work as a type of quantum entangler. For example, given a 
50:50 beam-splitter and the input beam of mode 1 containing one photon mode 
2 containing nothing. The output state is^=(|10) + |01)). Obviously, this is a 
maximally entangled state in vacuum-and-one-photon space. However, given 
another input state, the output state can be separable. For example, if the 
input is vacuum or a coherent state, the output is still vacuum or a (2-mode) 
coherent state. Actually, the output state is never entangled if the two-mode 
input state is classical (probabilistic mixture of coherent states). This can be 
regarded as a theorem. The proof is very simple: Any 2-mode coherent state 
\olx) ® \a 2 ) will simply become another 2-mode coherent state \ai) <S> \ot 2 ) after 
the beam-splitter transformation. Therefore, after passing the beam-splitter, 
the state will be another probabilistic mixture of coherent states which is still 
a classical state and must be separable (unentangled). Actually, no matter how 
many beam-splitters are used, the final multi-mode state must be separable 
given that the input light is in a classical state. Details can be seen in Ref . [38] 

Given the input of non-classical light, the output can be either entangled or 
unentangled[39]. We now demonstrate the entanglement property when two 
one-mode squeezed states are used as the input. Suppose the input states are 
the squeezed vacuum states in each mode, i.e. 

Pin = S(Q ® S(( b )\00)(00\S\( a )S\( b ), (101) 

where S a (( a ), Sb(Cb) are squeezing operators defined by 5(C) in Eq.(48). (Here 
(a = r a e l ^ a , Cfe = rf,e z ^ b .) The two- mode output state is a pure state and can 
be entangled. The quantity of entanglement of the output state is determined 
by the impurity of one mode. Suppose the output state of mode a is p oa . The 
quantity of entanglement of the output state is[l] 

E(p oa ) = tr(p oa lnp oa ). (102) 

After passing the beam-splitter, the two-mode state is 

U B S(( a )®S(( h )\00)=U\00). (103) 

As stated earlier in theorem 3, the covariance matrix of the output state can 
be derived based on the vacuum covariance matrix and the transformation 
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property of U. Explicitly, 



U ] (x a , p a , x b , p b ) T U = (M (a <S>M (b ) ■ M B x {x a , p a , x b , p b ) T 

and A4( a , M.( b are defined by Eq.(53), M.b is given in Eq.(84). Therefore 
the covariance matrix for the two-mode state after passing through the beam- 
splitter is 



(104) 



and jin is the characteristic matrix of the two-mode in-put state. This can be 
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written in the 2x2 block form of | a a | and 7^ 
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covariance matrix of mode a of the output state. The matrix elements of 7^ 
can be explicitly calculated from Eq.(104). Since the entanglement quantity 
as defined by Eq.(102) is unchanged by any local unitary operation, using 
an appropriate symplectic transformation, we can first transform 7^ into the 



diagonal form 



v 
v 



and 



v = V m n m 22 - mii- 



(105) 



This is the covariance matrix of a thermal state. Thus the quantity of entan- 
glement for the output state is: 



E{p c 



In 



u+1 



v — 1 V 
In 



v+1 



(106) 



The above equation together with the previous equations for the definition of v 
formulates explicitly the entanglement quantity. The maximum entanglement 
is achieved through maximizing v. This requests 



2(0i - fa) - (<p b - <Pa) = (2k + 1)tt, (107) 
where k is an arbitrary integer [39]. 

Summary: A beam-splitter can never produce entanglment with classical light. 
One can produce two-mode squeezed states given one-mode squeezed states 
and a beam-splitter. The entanglement of the output states can be optimized 
by adjusting the phase parameters of the input squeezed states. 
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2 Entanglement-based quantum tasks 

Many important tasks in QIP are based on quantum entanglement. They 
either directly need quantum entanglement resource, e.g., quantum teleporta- 
tion and dense coding, or the entanglement manipulation, e.g., entanglement 
purification, or creating entanglement in carrying out the tasks, e.g., cloning 
or quantum error correction, and so on. We shall review most of these tasks 
with Gaussian states in this section. But the issue of entanglement purifica- 
tion of strong bipartite Gaussian states is not included in this section since we 
have placed it in another section which is focus on the mathematical theory 
of quantum entanglement of Gaussian states. We now start with quantum 
teleportation. 



2.1 Teleportation with two-level states 

The idea of quantum teleportation was first proposed in 1993 [4] with two- level 
systems. Suppose a photon with Alice is in an unknown two-level quantum 
state in e.g., the polarization space. Definitely, if Alice wants to send the 
unknown quantum state to a remote party Bob, she can choose to simply 
send the photon to Bob. However, with the help of quantum entanglement, 
she has a better choice. Instead of sending the photon itself, she can only move 
the unknown quantum state onto a photon at Bob's side while not sending any 
physical particle to Bob, if she has pre-shared an EPR pair with Bob. By this 
method, in order to send any quantum information (unknown quantum state) 
to a remote party, one does not have to send its physical carrier. This process 
is called as quantum teleportation[4]. It is a bit different from the classical 
teleportation: here once an unknown state is teleported to a remote party, its 
original carrier has lost all information of the state. Alice cannot choose to read 
the state ( measure the state) first and then announce the result, because the 
original unknown state is changed once she reads it. Alice can neither choose 
to copy the state first and then send one copy to Bob, since the perfect cloning 
is forbidden by quantum non-cloning theorem[47]. 

2.1.1 Teleportation with two-level systems 

The task of quantum teleportation [4] can be achieved if they have pre-shared 
quantum entanglement. In figure 6, Alice and Bob initially share a perfect 
EPR pair, particle 2 and 3. Particle 2 is with Alice and particle 3 is with 
Bob. The two-level state of particle 1 with Alice is unknown. Alice measures 
particle 1 and 2 in the Bell basis first, then remotely instructs Bob taking 
a local unitary transformation according to her measurement outcome. After 
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Bell Measurement 



1 2 3 

Alice Bob 

Fig. 6. Quantum teleportation. Alice and Bob pre-share an EPR pair ( photon 
2 and 3). The unknown quantum state is initially carried on photon 1. The Bell 
measurement outcome at Alice's side is then broadcast. 

the local unitary transformation to particle 3 is done, particle 3 is exactly 
in the initial unknown state of particle 1. Now we demonstrate the idea by 
photon polarization. Suppose the unknown polarization state of photon 1 is 

\ X )x = a\H) x + p\V) x (108) 

and a, j3 are complex amplitudes satisfying | or | 2 + \[3\ 2 = 1. Photon 2 and 3 
are in a maximally entangled state in polarization space, e.g.: 

\r ) 23 = (\H)2\V) 3 - \V) 2 \H) 3 ) , (109) 

where \H) and | V) represents the horizontally- and vertically-polarized photon 
state, respectively. The initial state of all three photons is 

|^>123 = |x)l|^~>23, (HO) 

which can be equivalently written in 



1 



'123 - 2 



-|^-)12|X)3-|^ + )1 2 («I^)3-/9|^) 3 

H<f>-)iMVh + P\Hh) + \4> + )n(a\V) 3 - /3\H) 3 



'11V, 



One can easily see that after observing the outcome of Bell measurement on 
photon 1 and 2, the corresponding local unitary transformation to photon 3 
will produce the initial state \x) on photon 3. 

Remark: Quantum teleportation does not offer any faster-than-light communi- 
cation. Bob can only produce state \x) on photon 3 overtaking an appropriate 
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local unitary transformation instructed by Alice through classical communi- 
cation which cannot be faster than light. Without Alice's message about the 
outcome of her Bell measurement, the state of Bob's photon is not changed 
at all. 

In fact, the initial unknown state is not necessarily a pure state. It can be an 
arbitrary mixed state. Moreover, it can even be a part of a composite state. 
This can be demonstrated in the concept of entanglement swapping[48]. For 
example, if initially photon 1 is entangled with photon and the state for the 
composite system of photon 1 and is an antisymmetric state \ip~)oi- The 
total state of photon 0,1,2, and 3 is 

|V>)oi23 = l(\H)o\Vh - \V) \H) 1 )(\H) 2 \V) 3 - \V) 2 \H) 3 ). (112) 

After a Bell measurement on photon 1 and 2, these two photons will be pro- 
jected onto one of the 4 Bell states. To see what happens to photon and 
photon 3, we now recast the above state in 

\{\^ + )^ + )l2 + |V")03^") 12 + |0 + )O3|0 + )12 + |^->03|V'")l2). (H3) 

This means, in all cases photon and photon 3 becomes entangled despite the 
fact that they have never been interacted. This is the so called entanglement 
swapping [48]. 

Quantum entanglement itself can also help to raise the channel capacity of 
communication through quantum dense coding[49]. If they pre-share an EPR 
pair, Alice at her side can change the state of the whole pair into any one of 
the 4 Bell states. This helps her to transmit 2 bits information by sending one 
qubit. 

The task of quantum teleportation can also be done in position-momentum 
space with continuous variable states [50], which is called as continuous vari- 
able quantum teleportation, CVQT. One can use a two-mode Gaussian state 
as the entanglement resource which is pre-shared between Alice and Bob. Alice 
can then teleport an unknown state. If they have pre-shared perfect entan- 
glement resource, they can teleport an arbitrary continuous variable state. 
Perfect entanglement means infinite squeezing which doesn't exist in prac- 
tice. Luckily, if the unknown state is limited to the family of coherent states, 
one can teleport it with satisfactory fidelity through the practically existing 
two-mode finitely squeezed states. 
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2.2 CVQT with Gaussian states 

Similar to that of the 2-level states, given the pre-shared two-mode squeezed 
states, the CVQT can be performed to transfer the quantum state of mode 1 
to the remote mode 3. Suppose Alice and Bob have three light beams, beam 
1 and beam 2 are with Alice, beam 3 is with Bob. Beam 2 and 3 are in an 
entangled state, e.g., a two mode squeezed state. Their goal is to transfer the 
state of beam 1 into the remote mode 3 through the entangled beams 2 and 
3. The task can be completed by the following 3 steps: 

• 1. Alice takes the Bell measurement on beam 1 and beam 2, i.e., measuring 
both i\ — x 2 and p\ +p 2 . Suppose she has observed A and E as the outcome. 

• 2. Alice announces her measurement outcome A and E. 

• 3. Bob displaces beam 3 by A in position and E in momentum space. 

The state of beam 3 with Bob is now the outcome state of CVQT. There are 
3 main theoretical approaches to CVQT with two-mode squeezed states: the 
Heisenberg picture [51], the phase-space representation [52] and the Schrodinger 
picture [53,54,55]. 

2.2.1 CVQT in the Heisenberg picture 

The first proposal of CVQT was presented in the Heisenberg picture [51]. For 
clarity, we start from the case with perfect entanglement. Actually, the first 
proposal of CVQT assumed the perfect entanglement [51]. Say, initially, the 
light beams of mode 1 and mode 2 are maximally entangled, i.e., 

x 2 -x 3 = 0; p 2 + p 3 = 0. (114) 

The light beam of mode is the unknown field to be teleported. Alice then 
performs Bell measurement i.e., simultaneous measurement of X\ — x 2 and 
pi + p 2 on mode 1 and mode 2. Suppose she has obtained 

x\ - x 2 = A, pi +p 2 = E 

and A, E are real numbers as Alice's measurement outcome. Given this out- 
come and Eq.(114), the field of mode 3 can be expressed in 

x 3 = x x - A; p 3 = pi - E. 

After taking a displacement of A to x 3 and E to ^3 Bob can obtain the following 
result for mode 3 as the outcome field of the quantum teleportation: 

X 3 >Xtel=X\]fa >Ptel=Pl- (115) 
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The field of mode 3 after teleportation is exactly equal to the initial field of 
mode 1. 

In practice, the maximal entanglement resource is replaced by the two-mode 
squeezed state. In such according to Eq.(65), the initial field of the 

two- mode squeezed state is: 

x 2 - x 3 = e~ r (x { 2 0) - P2 + P3 = e~ r (p { 2 0) + p ( 3 0) ) (116) 

and the superscript "0" indicates the vacuum field. Given such an imperfect 
entanglement, the outcome field of mode 2 after quantum teleportation is 

x 3 — > xtei = xi + e" r (x2 0) - xf'); p 3 — > ptei = pi + e~ r (p^ +pf ) )- (117) 

The result is the same with the ideal one in the limit of r — > +oo. However, 
if r is finite, there will be noise for the outcome field. 

2.2.2 CVQT in phase space representation 

The teleportation outcome can also be presented in the phase space represen- 
tation. In the original paper of phase space representation CVQT, the Wigner 
function is used. Here we use the the characteristic functions only. 

There are three modes (light beams) in CVQT: mode 1 for the unknown state 
which is to be teleported; mode 2 and 3 are for the bipartite entangled state 
pre-shared by Alice and Bob. Also, there are three steps in the CVQT: 1. 
Alice takes Bell measurement on beam light 1 and 2; 2. Alice announces her 
measurement outcome of A for (xi — x 2 ) and E for (pi +p 2 ). Bob displaces his 
light beam, beam 3 by A in "position" space and £ in "momentum" space. 

The displacement operator for Bob in step 3 is -D(A, S) = exp(ix 3 £ — 2j3 3 A) 
as defined in Eq.(35). It would make no difference to the final outcome of the 
above stated CVQT if step 2 and step 3 above were replaced by the following 
non-local operator in step 3 

G = exp[-ip 3 (xi - x 2 )}exp[ix 3 (pi + p 2 )}- (118) 

This operator is non-local therefore cannot be implemented in any real tele- 
portation set-up. However, mathematically, the outcome state of the standard 
CVQT procedure is identical to that from the imagined one with such a non- 
local operator. We shall use this virtual procedure to deduce the general result 
of the outcome state of CVQT mathematically. Here we consider the ensemble 
outcome state of the CVQT with Bob, i.e., the state averaged over all possible 
values of A and S. If operator G were used, actually, Bob didn't need the clas- 
sical information announced by Alice in step 2, since we only care about the 
ensemble result of CVQT outcome here. Since the measurement operation in 
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step 1 and the displacement operator G commute, if one exchanges the order 
of the Bell measurement and G operation, the result should be unchanged. 
Therefore the ensemble result of the transferred state after the CVQT is 

Ptel = Tr li2 (G PlP2Z G~ l ) . (119) 

Here p\ and P23 are the initial unknown state of mode 1 and the pre-shared 
entangled state of mode 2 and 3, respectively. In this virtual protocol, there 
is no classical communication between Alice and Bob. Therefore the delayed 
Bell measurement at Alice's side can be actually omitted because the outcome 
state at Bob's side after unitary operation G will be unchanged no matter 
whether Alice does the Bell measurement at her side. Therefore to calculate 
the outcome state, we only need to first take unitary operation G and then 
take sub-trace of mode 1 and mode 2. 

Denote the initial characteristic function for the three-mode state to be 

Xo(0 = 6) • X2 3 (6, U, 6>, 60 ■ (120) 

£2) is the characteristic function of mode 1, X23(&, £4, £5, £e) is the char- 
acteristic function for the pre-shared entangled state (mode 2 and 3). Applying 
theorem 2 in section 1 to Eq. (119), we have the following characteristic func- 
tion of the CVQT outcome state 

60 = Xo(M T o | a=6=6=f4=0 (121) 

where M is defined as 

G ] RG = MR (122) 
and R = (x±,pi, x 2 ,p2, ^3,P 3 ) T . Using Eq. (34), one can easily find: 
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(123) 



Given this matrix, the characteristic function of the 3-mode state after unitary 
transformation G is 

x' o (0 = xo(m t o = Xl (^ 1+ ^ 5j ^ + e 6 ) X2 3(e 3 -£B,£ 2 +e 6 , -6-^3+6, -6+^+6). 

(124) 
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According to theorem 2, the characteristic function for mode 3 after telepor- 
tation is simply 



Xtel = Xo(M 0ki=6=6=?4=0 = Xl(6»&)X23(-6>, £6,65,6)) 



(125) 



which is just 



Xtei{^, &) = Xife, 6>) exp - -e^fe 2 + $) 



(126) 



Here we have used Eq. (67). From this we can see that there will be excess 
noise in the outcome state of teleportation, if r is finite. 

Similar to that of the two-level state, here one can also use the two-mode 
squeezed state to teleport quantum entanglement [50,56,57,58,59]. Say, ini- 
tially, there are 2 two-mode squeezed states of beam 1,2 with squeezing pa- 
rameter r a and beam 3, 4 with squeezing parameter r&. After measuring beam 
2,3 in the Bell basis, and an appropriate displacement operation on beam 1 
and beam 4, one can obtained a two-mode squeezed state for beam 1 and 
beam 4. The displacement can be carefully chosen so as to always obtain 
the same two-mode squeezed state with squeezing parameter r a b in the form 
e tanhr a( , _ g tanh r a tanh r b no ma ^ er w h a t result of the Bell measurement on beam 

2,3 is obtained [50, 59]. 

The CVQT result above is the ensemble outcome of the transferred state 
averaged over all possible measurement outcome at Alice's side, i.e., all pos- 
sible values of A and S. One can obtain the single-shot result through us- 
ing the Shrodinger picture. This can be done in the position-momentum 
representation[54], the coherent-state representation [55] and so on. A very 
useful single-shot result is given by Hoffman and coauthors in Schrodinger 
picture[53]. There, it is found that if Alice obtains her measurement outcome 
A, X, after Bob takes the displacement accordingly, the state transferred to 
Bob's side can be described by the so-called transfer operator T: 



where \ip)tei is the outcome state with Bob after the CVQT, |^ ) is the initial 
unknown state at Alice's side and 



tel — 



T(A,E)|^o) 



(127) 



f(A,S) 



1 — tanh r ~ 




7T 



and -D(A, S) = exp(— iAp + iT,x) as defined by Eq.(35). Besides these, there 
are also results about the CVQT in phase-number space[60,61,62] 
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2.2.3 Teleportation fidelity. 



As has been shown, if the squeezing parameter r of the pre-shared two-mode 
squeezed state is finite, there is always noise in the outcome state. An in- 
teresting question is whether we can obtain non-trivial outcome using finitely 
squeezed states only. The answer is positive if the initial unknown state is lim- 
ited to an unknown coherent state only. If there is no pre-shared entanglement 
resource, Alice and Bob may do the task trivially: Alice uses an optimized 
measurement to detect the state and then send her outcome to Bob through a 
classical channel. In this way, the fidelity of the outcome state and the initial 
unknown state cannot exceed 1/2. However, as shown below, in the CVQT 
with pre-shared two-mode squeezed states, the fidelity of outcome state and 
the initial unknown state is always larger than 1/2 provided that the squeezing 
factor is larger than 0. 

If the initial unknown state is a coherent state of \a = u + iv) = V(a)\0), the 
characteristic function given in Eq. (126) is for a displaced thermal state: 

Ptel = V{a) Pth {(3)V\a) (129) 

where pth((3) = (1 — e~P)e~ f3a]a is a thermal state and e~@ = d^ps? , which is 
a direct consequence of Eq. (72) and Eq. (73). The teleportation fidelity is 

F = (0\V\a)V(a)p th (a)V\a)V(a)\0) = (0\p th (r)\0) (130) 

which is simply 

F = l - e '" = T^-r- ( 131 ) 

1 + e 2r 

This result is independent of the parameters u, v. This is to say, all coherent 
states can be teleported with the same fidelity. The fidelity is larger than 
1/2 [63] provided that r > 0. Since no classical scheme can teleport an unknown 
coherent state with the fidelity larger than 1/2 [63], the result shows that the 
CVQT scheme can produce a non-classical result in teleporting an unknown 
coherent state given any small squeezing for the pre-shared two-mode squeezed 
state. 



2.3 Experiment 



There are 3 major steps in quantum teleportation: 1) Sharing quantum en- 
tanglment. The two-mode squeezed state can be regarded as the pre-shared 
entanglement if the two modes here are spartially separated. 2) The Bell mea- 
surement. This requires to simultaneously measure the quantity of x\ — X2 and 
pi +p2- This can be done by the homodyne detection. 3) The appropriate dis- 
placement operation dependent on the Bell measurement outcome. One can 
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Entanglement source 

Fig. 7. Experimental set-up for the quantum teleportation with Gaussian states. 
B: 50:50 beam splitter, m : mirror. Mx, Mp: displacement operation. LO: local 
oscillator. Beam 1 is the income unknown coherent light which is to be teleported. 
Beams il, i2 are two single- mode squeezed states. Beam 2,3 are two-mode squeezed 
state which is used as the entanglement source. Beam 4 is the outcome state which 
is produced by taking appropriate displacements to beam 3. 

see details in the figure 7. The first teleportation experiment with two-mode 
squeezed states is done in 1998 [64]. In the experiment [64], they have teleported 
an unknown coherent state with intensity changing in a large range. The aver- 
aged fidelity of the outcome state and the input unknown state is around 0.58. 
On the other hand, no classical method can reconstruct an unknown coherent 
state with a fidelity larger than 1/2 [63]. 

To keep the optical coherence, Alice and Bob must share the same local oscil- 
lator or be phase locked to one strong reference coherent light. The two mode 
squeezed states must also be phase locked to the local oscillator. Details of 
the coherence and the validity have been discussed in [65, 66] . According to 
Ref . [66] , the validity of existing experiment can be explained in this way: The 
protocol requires Alice and Bob share the same reference light. This can be 
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regarded as the classical communication for the calibration of measurement 
basis. Given the shared reference light and the fact that all those two-mode 
squeezed states are phase-locked to the reference light, the quantum coher- 
ence has been kept very well, it is something like multi-mode fields with same 
phase. Here, since they can only use finitely squeezed states, the teleportation 
fidelity is limitted. It is then interesting to ask the fidelity criterion for a good 
quantum teleportation with 2-mode squeezed states. There are several differ- 
ent viewpoints. A necessary condition for the a non-classical teleportation of 
an unknown coherent state is 

F av > \ (132) 

and F av is the teleportation fidelity averaged over all coherent states. This 
condition is required since otherwise one can make it without entanglement 
resource [63]. Another viewpoint [67] sets the necessary condition to be 

F av > 2/3 (133) 

since one may clone an arbitrary coherent state with a fidelity 2/3 [68]. Besides 
these, there are also other criteria[63,69]. Among all the existing experimental 
results of teleporting unknown coherent states[64,70,71], the highest average 
fidelity achieved is around 0.64. 

2.4 Dense coding with two-mode squeezed states 

In the two-level-state case, one may implement quantum dense-coding using 
the pre-shared EPR states. In such a way, he is able to realize two-bit classical 
communication through sending one qubit only. The role of quantum entan- 
glement and the advantage to the simple qubit-sending is clear: if they don't 
pre-share an EPR pair, one qubit can only carry one bit classical information. 

Similar results also exist in CV state case [72,73]. Here they need to pre-share 
a two-mode squeezed state. Alice takes an arbitrary displacement, Di(A, E) 
to her beam and then sends her beam to Bob. By a Bell measurement X\ — x 2 
and pi + p2, Bob obtains information of two parameters, A and S. In the 
case of infinite squeezing of their pre-shared state, Bob can obtain the two 
parameters exactly. However, we need to know the result in the case they 
only pre-share a finitely squeezed two-mode squeezed state. And we need to 
study the advantage to the case of simply sending a light-beam with certain 
common constraint, e.g., the same averaged photon number of the states. After 
calculation [73], it is found that the channel capacity of a two-mode squeezed 
state can be larger than that of a coherent state or a single-mode squeezed 
state. If they use very bright light (i.e., the average photon-number of the state 
is very large), the channel capacity of a two- mode squeezed state is nearly 2 
times of that of a coherent state or a single mode squeezed state. Explicitly, 
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the channel capacity of a coherent state and that of a two-mode squeezed 
state can be found in, e.g., [73,50]. We shall present the details in section 6.4. 
Experimental works on dense coding with two-mode squeezed states have also 
been done [74]. 

2.5 Quantum error correction codes 

The purpose of a quantum error correction code (QECC) is to process quan- 
tum information robustly in the presence of noise. 

Let's first consider a simple example in classical communication through a 
noisy channel. Each time we want to transmit one bit information which is 
either or 1. Since the channel is noisy, it flips the transmitted bit with 
probability p. This is to say, sometimes is changed into 1 and 1 is changed 
into during the transmission. The channel error rate here is p. However, we 
can decrease the error rate by using error correction code of the following: 



After the transmission, we recover the bit value of each code by the majority 
rule. In such a way, the error rate is decreased to 3p 2 (l —p) +p 3 . If the channel 
noise (p value) is small, the final error rate drops drastically. 

In the quantum information processing, there are something similar to this, 
but there are also something different. We can still use the same majority 
rule to correct bit-flip errors, but the initial state is in general an unknown 
linear superposition of |0), |1), the trivial repetition code doesn't work and 
quantum entanglement has to be involved. Also, we need to add something 
else to correct phase-flip errors. 

Say, in general, we want to protect an unknown state of the form 







000; 1 



111. 



(134) 



|VU =a\O)+0\l). 



(135) 



A bit-flip error changes the state into 



<7 6 |V>u) = a|l) + /3|0). 



(136) 



A phase-flip error changes the state into 



<7phk,) = a|0)-/3|l). 



(137) 



A simple quantum code of 



|0) ® |00) -> |000); |1) <8> |00) 



111) 



(138) 
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can decrease the bit-flip errors. Using such a code, any unknown state \ip u ) = 
a\Q) + j3\l) is encoded by a|000) + /3| 111) , which is normally an entangled 
state. This code can not remove phase-flip errors. Say, the channel noise can 
also change the state into a\0) — /3\1). To correct both types of errors, we can 
use a more complete QECC[75,76,77,78,79,80]. For simplicity, we demonstrate 
the main idea here with Shor's 9-qubit code [75]. 

Given any unknown two-level quantum state of equation (136), we shall first 
encode it with the 3-qubit phase-flip code, i.e., |0) — > |000) and |1) — > |111), 
and 

|0> = H\0) = -L(|0> + |1»; |1> = H\1} = -L(|0) - |1». (139) 

Here H is the Hadamard transform. We shall then encode each qubit again 
by eq.(138) against the bit-flip errors. In such a way we have a 9-bit code of 
the following: 



^ _ (|ooo) + |m))(|ooo) + |m))(|ooo) + |iii)) 
1 ; ~" 1 )ec 2V2 

Hv^m (|000> — |111»(|000> — |111»(|000> — 

After sending out the quantum code a|0) ec + /3|l) ec , if there is at most one bit- 
flip error and at most one phase-flip error, we can always detect the positions 
of flip precisely and recover the original code. Consider the 3 qubits in the 
first bracket. We first measure the parity of qubit 1 and 2 and obtain z 1(S2 , 
and then measure the parity of qubit 1 and 3 and obtain 2193. If both of them 
are then there is no bit-flip error. If both of them are 1, then qubit 1 must 
have been flipped and we flip it back. Similarly, zi e2 = 0, zi e3 = 1 means 
qubit 3 is wrong and the opposite result means qubit 2 is wrong. Such type 
of parity measurement does not destroy the code state itself. After we take 
such type of parity check to all 3 blocks, we can locate and correct the only 
bit-flip error, if there is one. We can also correct any phase-flip error. Suppose 
there is only one phase flip. In each block, if any qubit is phase flipped, the 
block state is changed from ^(|000) ± 1 1 1 1> ) into ^(|000) =F |111>). We can 
take another type of syndrome measurement by comparing the "phase" parity 
values of different blocks. Say, ^=(|000)±|111)) corresponds to the phase value 
0, 1, respectively. We can first measure the phase parity of block 1,2 and then 
measure that of block 1,3 and we can determine the phase flipped block if 
there is at most one block that is phase flipped. Therefore, if there is not more 
than one wrong qubit, we can always recover it to the perfect code and the 
original quantum state is protected perfectly. 

In making the 9-qubit code, we have used one important fact: to correct the 
phase flip error, we need first do a basis transformation and then construct the 
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code in the conjugate basis, i.e., from basis (|0), |1)} to {|0), |1)}. The similar 
idea can also be used to construct the error-correction code for an unknown 
continuous variable state[81]. Here we also have two conjugate basis, {\x)} and 
{\x)} which we shall call position basis and momentum basis, respectively. To 
use the idea of 9-bit code for the two level case, we need the relationship 
between state \x) and state \x). In the two level case, the two conjugated 
bases are connected by Hadamard transform. In the CVQT case, we have the 
fact that 

\x) = H c \x) = 4= / e 2lxy \y)dy. (141) 

where we have used the notation \x) for a momentum eigenstate with the value 
of the momentum being x, i.e., \x) = \p = x). 

Analogously to the 2-level QECC case, we can now use the following code for 
any state in position space 

1 f 

\Xencode) = J e 2lX{Vl \y ± ? y ± ? \y % y 2 ) y 3 ? ch/ld^d^. 

(142) 

It can be easily examined that any displacement error or phase error can be de- 
tected and corrected, if there is at most one displacement or phase error in the 
9 "qubits" . It has been shown that such a 9-qubit QECC can be implemented 
with linear optics and squeezed lights [81]. 

More generally, suppose q is any possible channel action. The sufficient and 
necessary condition for quantum error correction is[78,79] 

( X encode\^i^j\ X encode) = 8(x — x)Xij. (143) 

and Xij is a complex number independent of encoded states. It has been shown 
that similar to the case of 2-level states, an effective QECC code for the 
continuous variable states can be constructed by fewer qubits, e.g., only 7 
qubits of 5 qubits [82,83]. 

In the above, we have assumed the condition that there is at most one dis- 
placement error or phase-shift error in the code. However, a continuous vari- 
able state will always have some small errors. That is to say, it is impractical 
to request that only one mode in the quantum code has errors. This will limit 
the application of the above continuous variable QECC in practice. To avoid 
this difficulty, one can also use Gaussian states to encode a discrete-level state 
for error correction [84]. We can construct an encoded two-level quantum state 
based on the properties of the following operators 



S x = e 2 ^; S p = e" 2 ^ (144) 
It can be easily examined that these two operators commute and there are 
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two common eigenstates: 



|0) oc V] \x = 2s^fn) oc V] |p = s^/^l)■, 

— oo — oo 

oo oo 

|1) oc 2 |x = (2s + l)v^) oc X^(-!) S b = s vM- (145) 

— oo — oo 

This code can protect an unknown state against errors that induce shifts in 
the value of x and p. Any unknown state of the type 

$) = a\0)+P\l), (146) 

is an eigenstate of operator S x and also an eigenstate of S p . Therefore, it does 
not destroy the state if we measure both values of x modulo ypii and p modulo 
s/tt. After the measurements, we can correct small shift errors by a translation 
operation to displace x and p to their nearest integer multiples of y/ir. If the 
error induced shifts of both x and p are less than yf~K/2, the initial encoded 
state can be restored perfectly. 

The encoded state here is a linear superposition of infinitely squeezed states 
in q and p. Now we consider the practical case that we only have a finitely 
squeezed states. Suppose we encode state |0) by 



oo 

■\2 /A2 



(x-Wi) 2 /A2 



/ A \ 1/4 « uvj 

|0> ~ (l) J dx\x)e-^ A > 2 x £ 

dp\p)e-^ p2 x £ e -!(p-Vi) 2 /Ai. ( 147) 

If A x and A p are small, then in principle these shifts can be corrected with 
high probability. In the special case that A x = A p = A, it can be calculated 
that the probability of uncorrected error caused by A is bounded by [84]: 

2A 

Pe<—exp(-7r/4A 2 ). (148) 

Obviously, we can also concatenate a shift-resistant code with many Gaussian 
states. 



2.6 Gaussian cloning transformation 



It has been shown [4 7] that the perfect quantum cloning machine does not exist 
because it violates the linear superposition principle in quantum mechanics. 
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Say, given an arbitrary state map Co satisfying the following condition 
does not exist: 

Q>(hA» = hAM. (149) 

The idea for the proof is simple. Consider the 2-level system. If Co exists, it 
must satisfy 

Cb(|0» = |00>; G,(|l» = |ll). (150) 
The linear superposition principle requires the same map to satisfy 

C (|+» = ^(|00) + |11». (151) 

However, if Co is a perfect cloning map, we request the conflicting result of 
Co(|+)) = I + +)• This shows that Co cannot clone an arbitrary unknown 
2-level state perfectly. If it clones |0) and |1) perfectly, it cannot clone state 
|+) perfectly. 

However, the quantum approximate cloning machines do exist [85]. We label 
the input unknown state by subscript 1 and the two ancilla by 2 and 3. The 
approximate cloning process can be mathematically described in: 

C(|V)i|0) 2 |0) 3 ) = |V')i23- (152) 

We then discard qubit 3 and we want to have large values for the following 
quantities (the cloning fidelity) :{if)\pi\if)} and (-0 1 IV 7 ) an d Pi, Pi are states of 
qubit 1, 2 respectively, after tracing out qubit 3 of the output state |^')i23- 
This is the so called 1 — ► 2 cloning. The same concept can be extended to 
M — > N cloning. Various types of cloning machine have been investigated 
for 2-level states[85], or even for discrete d— level states[86]. The problem has 
then been investigated with the continuous variable states [68] by Cerf, Ipe 
and Rottenberg (CIR). In particular, a type of Gaussian cloning machine is 
constructed explicitly. CIR considered the displacement invariant Gaussian 
cloning machine. Say, if two input states are identical up to a displacement 
D(x',p') = e~ lxp e lpx as defined by Eq.(35), their respective copies should be 
identical up to the same displacement. Mathematically, the 1 — ► 2 cloning 
machine C satisfies 



C 



D(x' ,p')\il))(ip\D\x ,p') \ = D(x',pT 2 C[\^)(^\}D\x',p'f 2 - (153) 



We now consider 3 modes. Mode 1 is for the unknown input state denoted by 
Mode 2 and 3 are ancilla. After the cloning map, we discard mode 3 and 
mode 1,2 are the outcome of 1 — » 2 cloning. Without loss of any generality, 
we set the initial state of mode 2 and 3 to be 

p poo 

Ix) 2 ,3 = / / f(x,p)\V(x,-p)) 2 ,3dxdp, (154) 
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where f(x,p) is an arbitrary complex amplitude function and 



\*(x,p)) = -= / e™\y)\y + x)dy. (155) 

The cloning transformation is 

U = q-^-^pi e -ixi(p2+p 3 ) (156) 

This is actually the analogy of qubit cloning transformation [85]. After applying 
U to the state |^)i|x)2,3, we obtain the following 3-mode state: 

f(x,p)D(x,p)\i/;)i\^(x, -p)) 2 , 3 dxdp, (157) 

where mode 1 and mode 2 are taken as the two output states of the doner. 
This class of cloning machines are parameterized by f(x,p). If we choose 
f(x,p) = e~( x +p ^/y 7 ^, the doner will provide two identical copies. For an 
arbitrary input state the noise of each output mode is a 2 = 1/2 and the 
state is 

Pl =P2 = - f r e- x2 - p2 D{x,p)\ij)(ilj\D\x,p)dxdp. (158) 

7T J J~oo 

In particular, if the input state is the coherent state = \a), the cloning 
fidelity is 

1 2 

(a\pi\a) = {a\pi\a) = ^ 2 = -. (159) 

This cloning fidelity is independent of a. It can be regarded as the Gaussian- 
state analogy of the qubit doner. Note that the cloning noise here is larger 
than that of qubit doner. The result can also be extended to the 7V — > M 
cloning[87], in analogy with that of a qubit-cloner[88]. The cloning transfor- 
mation here has been proven to be the one that offers the largest fidelity in 
principle[68,88,89] because cloning transformation can not help one to estimate 
an unknown state better than the known result of optimized measurement. 
The result can be extended to clone a squeezed state[68]. Optical implementa- 
tions have been also proposed[90]. One can also do telecloning with quantum 
entanglement[50,91]. An excellent review about quantum cloning has been 
presented very recently [89]. 



2. 7 Entanglement-based quantum tasks with weak Gaussian states: post- selection 
vs non-post-selection 



Most of the important results of entanglement-based quantum information 
for two-level systems have been experimentally demonstrated, e.g. [12,92]. The 
heart of the experimental demonstration is the generation and manipulation 
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of quantum entanglement. Photon polarization is the most natural choice for 
the entanglement space because it is easy to manipulate. However, there is no 
simple way to generate the perfect EPR state deterministically in polarization 
space. In the existing experiments, probabilistic EPR states are generated 
by spontaneous parametric down conversion (SPDC). Actually, the entangled 
state generated by the SPDC process is a type of mulit-mode weak Gaussian 
state in the form 



where the vacuum state |0) is the abbreviation of two- mode vacuum, the sub- 
scripts of each creation operators indicate the polarization and (3 is a complex 
number with \ f}\ being very small. Normally, we only need to consider the one- 
pair state from the Taylor expansion given that \f3\ is very small. However, in 
the existing experiments, the photon detector normally does not distinguish 
photon numbers exactly, one can only observe whether it clicks. If the inci- 
dent light beams contains one or more than one photon, the detector may 
click. Given this fact, the higher order terms in the weak Gaussian states take 
a non-trivial role and in many experiments one may only choose the exper- 
imental results by post selection. However, by carefully designing, in some 
cases one can still obtain the non-post-selection results. In this subsection, 
we shall first demonstrate how the higher order terms in the weak Gaussian 
states from SPDC process can have non-trivial effects and what is the so called 
post-selection result by the example of quantum teleportation. We then show 
how to convert the post-selection result to non-post-selection result by two 
examples, quantum teleportation and quantum entanglement concentration. 

2. 7. 1 Post-selection 

Consider the set-up of the first teleportation quantum experiment in figure 
8. In the ideal case, one EPR pair is generated at each side of the nonlinear 
crystal, i.e., beam 1, 2 is a pair and beam 3, 4 is another pair. After the 
polarization of beam 2 is measured, the polarization of beam 1 is known and 
therefore an arbitrary polarization can be prepared on beam 1 by rotation. 
(The rotation is not drawn in the figure.) Beam 1 and 3 are then sent to a 
beam-splitter for an (incomplete) Bell measurement. As shown already, if there 
is one and only one outcome photon on each side of the beam-splitter, beam 
1 and 3 have been collapsed to the anti-symmetric EPR state and the original 
polarization state of beam 1 has been teleported into the remote photon in 
beam 4, up to a fixed unitary rotation. If detector D2 could distinguish the one- 
photon state and the two-photon state, the set-up can be used as a teleporter 
without post-selection. However, since the detectors there cannot distinguish 
one photon and two photons, the result becomes more complicated [93]. What 
we can observe is whether the detector clicks or not. It is also possible that 
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Fig. 8. The set-up of the first teleportation experiment in polarization space. C: 
nonlinear crystal, P: pump, BS: 50:50 beamsplitter, M: mirror, Di: photon detector. 

initially beam 1, 2 contain two pairs while beam 3, 4 are vacuum. Suppose D2, 
D3 and Dl all click. There is considerable possibility that beam 4 is actually 
vacuum. That is to say, whenever we have observed the three-fold coincident 
event of Dl, D2 and D3, we are actually not sure whether the teleportation 
has been done successfully, since D2 doesn't distinguish one photon or two 
photons. To ensure a successful teleportation, we need to also observe beam 
4. But once beam 4 is observed, the state is destroyed. We call such type of 
results as post-selection-result because once we are sure of a successful result, 
the outcome state is destroyed already. Obviously, if there is a sophisticated 
photon detector which distinguishes one-photon and two-photon beams, the 
issue will be resolved[?]. Or, we can use strong entanglement in the position- 
momentum space as shown earlier in this section, because the strong two-mode 
squeezed state is deterministically entangled in position-momentum space. 
Actually, this non-post-selection property is an important advantage of bright 
Gaussian states for QIP tasks. Interestingly, even with weak Gaussian light, 
the entanglement-based experiments for two-level systems can be done without 
post-selection in some cases. 



2.7.2 Non-post-selection teleportation 

One can still use the same set-up, but the pump light after reflected back 
by the mirror in figure 8 is weakened [94, 95]. For example, we can weaken 
the reflected pump light to 1/20 of its original intensity. In such a way, once 
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the event of 3-fold clicking of D1,D2, and D3 is observed, the possibility of 
a successful teleportation is more than 20 times larger than the posibility of 
nothing on beam 4 [95]. Mathematically, the initial Gaussian state is 



|SPDC) = exp 



2g( a m a 2H + a lv a 2V 



cxp 



|0). (161) 



Doing Taylor expansion to the order of /3 2 , we have the following approximate 
4-photon state 



|SPDC 4 ) « ^{a\ H a\ H + a{ v a\ v ) 2 \0) + ^|$ + ) 12 ® |*+) M 

+f(4 H al H + al v al v ) 2 \0) (162) 

and \<p + )ij is a perfect EPR pair state for beam i and j. Since we request 
detector D2 click, the state of the third term is excluded. Once the event 
of 3-fold clicking of Dl, D2 and D3 is observed, the initial state of \SPDC) 
could have been collapsed to either the first term or the second term in the 
above formula. But, the prior probability for the second term is 20 times larger 
than that of the first term. Therefore, with very large possibility the initial 
state contains one pair at each side of the crystal. The experiment has been 
done sucessfully[95]. Here the main technique used is to decrease the prior 
probability of those unwanted terms. The similar technique can also be used 
for non-post-selection entanglement swapping with SPDC state, in the two- 
level space of vacuum and one-photon [96]. However, weakening the probability 
of unwanted term is not the only way to remove the post-selection condition. 
For different tasks we have different ways. 



2.7.3 Non-post-selection entanglement concentration 
The following raw state 

\r, <p) = -^—^{\HH) + re*\W)) <8> (\HH) + re i4> \VV)) (163) 

can be probabilistically distilled into the maximally entangled state without 
post select ion [9 7], even though the normal yes-no single photon detectors are 
used. Note that in Eq.(163) , both r and <p are unknown parameters. The ex- 
isting experiments have demonstrated the post-selection results[98,99]. In par- 
ticular, the special case r = 1 is the one treated in the recent experiment [98]. 
Consider the schematic diagram, figure 9. (Earlier, a similar scheme was given 
in[100,101] for another experiment.) The scheme requires the two fold coin- 
cidence event as the indication that the maximally entangled state has been 
produced on the outcome beams 2', 3', i.e. whenever both detectors D x and D w 
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click, the two outcome beams, beam 2' and beam 3' must be in the maximally 
entangled state: 

|$ + >2', 3 ' = -j=(\H)2,\H) 3 ,\ + V) 2 ,\V) 3 ,). (164) 

Now we show the mathematical details for the claim above. The polarizing 
beam-splitters transmit the horizontally polarized photons and reflect the ver- 
tically polarized photons. For clarity, we use the Schrodinger picture. And we 
assume that the non-trivial time evolutions to the light beams only take place 
while the light pass through the optical device. 

Consider Fig. 9. Suppose initially two remote parties Alice and Bob share two 
pairs of non-maximally entangled photons as defined by Eq.(163), denoted by 
photon pair 1,2 and photon 3,4 respectively. The half wave plate HWP1 here 
is to change the polarization between the horizontal and the vertical. After 
photon 3 and 4 each pass through HWP1, the state is evolved to: 

-J-^(\HH} 12 + re^\VV} 12 ) ® (\VV) 34 + re^\HH} 34 ). (165) 

Furthermore, after the beams pass through the two horizontal polarizing beam- 
splitters( denoted by PBS1), with perfect synchronization, the state is 

|x'> = T ^(|^>v|^>2' + re^|y)3^)40®(l^>i|^)2 + re^|if) 3 | J H")4). (166) 
1 + r z 

This can be recast to the summation of three orthogonal terms: 

\^) = t^(\A) + \B) + \C)), (167) 

where 

\A) = re t4, (\H) v \H) 2 ,\H) v \H) A , + \V) V \V) 2 ,\V) 3 ,\V) AI )- (168) 



\B) = \H) v \V)v\H) 2 ,\V) 2l] (169) 

\C)=r 2 e 2i *\H) 3 ,\V) y \H) A ,\V) 4 , (170) 

Obviously, term \B) means that there is no photon in beam 4' therefore this 
term never cause the requested two-fold coincident event and hence it is ruled 
out. Similarly, term \C) can also de disregarded and only term \A) should be 
considered. 

After the beams pass through HWP2, state \A) is evolved to 

|$ + )l"4"| $+ )2'3' + |* + )l»4»| $ ~)2'3' (171) 
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Fig. 9. Non-post-selection quantum entanglement concentration by practically ex- 
isting device of linear optics. The two-fold coincident event of both detector D x and 
detector D w being clicked indicates that a maximally entangled state is produced on 
beam 2' and 3'. PBS: polarizing beam-splitter. Here HWPl rotates the polarization 
by it/2, HWP2 rotates the polarization by it/4. 



where |$±) y = ^(\H)i\H) j ± \V),\V) 3 and |¥±) y = j 5 (\H) i \V) j ± \V),\H) y 
After pass through the two PBS2 in the figure, \A) is evolved to state 



x)\w)\^> + ) 2 ^ + \y)\z)\<S> + ) 2 > w + {\x)\z) + \y)\w))\Q-)w (172) 



where \s) denote the state of one photon in beam s, s can be x,y,z or w. 
From the above formula we can see that only the first term will cause the 
requested two- fold coincident event. This term indicates a maximally event- 
ready entangle state between beam 2' and 3', i.e. -^(\H) 2 '\H) 3 i + \V) 2 >\V)y). 
Note that the result here is independent of the parameters r, <fi. 

To really produce the event-ready entanglement through the concentration 
scheme here one need the deterministic supply of the requested raw states. 
This is rather challenging a task. However, as it has been shown [9 7], even 
without such a deterministic supply, one can still experimentally demonstrate 
that the scheme can produce the event-ready maximally entangled pair if the 
requested deterministic supply of raw state is offered. 

Remark: The non-post-selection scheme for QIP is not limitted to teleportation 
and entanglement concentration, e.g., there are non-post-selection schemes for 
the tsak of state Gaussification[102,103]. 
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3 Quantum cryptography with weak coherent light 

3. 1 Introduction 



Security has been an important issue for the communication over the networks 
these years. The internet traffic has been growing rapidly to include important 
information, such as a huge amount of orders for exchange markets or the deci- 
sion of a government. Modern economies and societies rely on the availability, 
confidentiality and integrity of critical fiber optic network infrastructures to 
function properly and efficiently Recent deregulation improves the accessi- 
bility to the networks and encourages new services. It also results in a side 
effect that increases vulnerability against the illegal tapping to steal confi- 
dential and commercially sensitive data. Encryption, usually public-key and 
secret-key cryptosystems, is one of the best means to keep such confidential 
from the malicious eavesdroppers. However, those cryptosystem only provides 
so called computational security, relies on the fact decryption requires imprac- 
tically long time for the current computers. The encryption systems may be 
broken with the enormous calculation or the sudden appearance of the poly- 
nomial algorithm, even before a quantum computer runs Shor's algorithm to 
solves the RSA cryptosystem. Also, some of the widely believed secure classical 
cryptographic system have now proven to be indecure[104] 

It has been proven that the secret key cryptographic systems are secure as 
long as the key is not used more than once (one-time-pad or Vernum cipher.) 
This method needs the unrealistically vast pool of the encryption key, thus in 
practice, one finite key is repeating, causing the debilitation of the conceal- 
ment. Quantum key distribution (QKD) provides a protocol where the sender 
(Alice) and the legitimate receiver (Bob) can share the same bit sequence suc- 
cessively without leaking any secret key information guaranteed by the law of 
quantum mechanics. This unconditional security, which cannot be achieved by 
conventional cryptography, clearly shows the advantage of the quantum infor- 
mation technology. Unlike other quantum information protocols proposed so 
far, QKD can be implemented with current photonic technology. Therefore, 
number of papers have reported the QKD transmission experiments. 

In the following, we will consider a QKD protocol, so called BB84 (Bennett 
and Brassard 1984) [3] in particular. BB84 protocol has been proved to be un- 
conditionally secure, if implemented with a perfect single photon source. It 
is, however, still difficult to provide a single photon source with a practically 
meaningful specification. Almost all the experiments towards practical imple- 
mentation employ weak coherent light from semiconductor lasers instead. We 
will first briefly review the theoretical backgrounds of the unconditional secu- 
rity in BB84 protocol. Then we will discuss practical implementations of the 
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protocol. Possible attacks to the QKD system using a weak coherent light will 
be examined. We will focus on the basic issues and the recent experimental 
progress. Readers who are interested in the detail of QKD should refer the 
review by Gisin et al. [13], where they would find good introduction of the 
QKD protocol and state of art at 2001. 



3.2 QKD in practice 



3.2.1 Requirement for single photon detectors 

In QKD systems with a single photon or a weak coherent light, we need to send 
and receive signals encoded in single photon states. One of the most important 
device in QKD transmission is single photon detector (SPD,) which limits both 
the transmission distance and the transmission rate. The SPDs should show 
high detection efficiency, low dark counts, and short response time. The ratio 
of the detection efficiency n to the dark count probability P d determines the 
error rate e#, as 



lS(l-v)r) + P t 



2 Pdet 
1 S(l-v)+P d / V 

2S{l-P d ) + P d /n' 



(173) 



where v is the visibility of the interferometer, and Pdet represents the detec- 
tion probability per pulse. Pdet is related to the probability S that at least 
one photon arrives at the detector by 

Pdet = Sn + P d - S V P d . (174) 

The probability S is a function of the loss in the transmission line and the 
receiver. The photon loss in a L km-long- fiber is given by aL [dBj.When we 
assume the receiver loss is (3 [dB], S is given by 

S = kt^^)/ 10 (175) 

for a single photon source, and 

S = 1 - exp [-^lO-^+^Z 10 ] (176) 

for a coherent photon source with the average photon number of fi. The error 
rate (173) is given by the half of the inverse of signal-to- noise ratio S/N (noise 
will give the error with the probability of 1/2.) Eq.(173) shows that the ratio 
P d /n is a figure of merit of a SPD that determines the error probability, because 
P d and 1 — v are small. Secure QKD can be achieved only when the error rate 
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is kept lower than a threshold for security. The threshold varies according to 
the assumptions on the method of Eve's attack and error correction. Typical 
threshold value is around 11 %[105,106]. Then the ratio P d /r] should be smaller 
than 10~ 3 for 100 km fiber transmission in 1550 nm, where the commercial 
fibers take the lowest loss value (0.2 dB/km), even with an ideal single photon 
source. 

Response time of SPDs may limit the clock frequency of the system. SPDs 
cannot detect photons during the recovery time (typically several hundreds 
nanoseconds) after one detection event. Another effect (sometimes more se- 
rious) is the afterpulse, false photon detections caused by residual electrons 
created by the previous detections. We can not send a photon pulse during the 
period of large afterpulse probability. The afterpulse effect remains typically 
1 /is after the photon detection. This period may vary on the devices and the 
operating conditions. The afterpulse effect on error probability can be formu- 
lated as follows. We assume two detectors 1 and 2 to discriminate bit values 
and 1, respectively. The probabilities pi(t n ) that detector 1 fires and p2{t n ) 
that detector 2 fires are given by the bit value b(t n ) = {0, 1} at the n-th clock 
as 

n-l 

pi(t n ) =S m (t n ) + P d + f(tn-U)pi{ti) (177) 

i=— oo 

n-l 

P2(tn)=S V (l-q(t n )) + P d + ]T fiK-t^U) (178) 

i=— oo 

where the function 



q(t n ) = v(l- b{Q) + (1 - v)b{t n ) (179) 

defines the fraction that a photon enters the detector 1, and the memory 
function f{t n — ti) represents the afterpulse effect. A reasonable form of / 
might be f(t) = Aexp[— / yt], but here we assume 



/(*) 



A (0<t< t M ) 

1 " , (180) 

(t<0,t>t M ) 



for simplicity. The afterpulse probability A remains constant during M periods 
of the clock in this model. Then Eq. (178) can be solved for the asymptotic 
values. The error probability is given by 

e B = l^+^H + V ~ l l 2 AM *e B + '-AM, (181) 
l + 2P d /Sr ] l + 2P d /S V 2 ' K J 

if we neglect the events that both detectors fire simultaneously. Eq.(181) shows 
that the afterpulse effect increase the error probability by AM/2. For example, 
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typical values A = 10~ 3 and M = 100 increase the error probability by 5 %. 
The afterpulse effect can be reduced by neglecting the photon detection during 
the time < t < t^. 

Devices for single photon detection must have a multiplication process inside 
the device: single photon detectors should yield many carriers from one pho- 
ton, otherwise the amplifier noise will hide the signal. Avalanche photodiodes 
(APD) are widely used for the SPD, because of the high detection efficiency. 
A bias voltage higher than the break down is applied to the APDs to ob- 
tain large avalanche gain (order of 10 6 ). The bias voltage should be decreased 
below the break down voltage after photon detection to quench the break 
down. This operation mode is called Geiger mode. Several methods are given 
to quench the APDs. The simplest one is called passive quench to put a high 
resistance in series to the APD. The break down current induce voltage drop 
in the resistance. More sophisticated method is active quench to use a circuit 
to detect the break down and decrease the bias. Si- APDs provides good per- 
formance for visible photon detection. Commercially available SPD modules 
detect single photons with the efficiency of rj « 50%, while the dark count 
rate is kept at 100 counts/sec. However, the single photon detection in 1550 
nm, which is suitable for fiber transmission, is still a big issue for the ex- 
periment. The QKD experiments in 1550 nm have employed the SPDs using 
InGaAs/InP APDs as APDs with InGaAs absorption layer have sensitivity 
at this wavelength. However, the InGaAs/InP APDs in Geiger mode are suf- 
fered by large dark count probability and afterpulse, which cause errors in the 
qubit discrimination. The dark count probability and the afterpulse can be 
reduced by using gated-mode, where gate pulses combined with DC bias are 
applied to the APD. The reverse bias exceeds the break down voltage only in 
the short pulse duration. Though the gated-mode works well, the short pulses 
produce strong spikes on the transient signals. High threshold in the discrimi- 
nator is therefore necessary to avoid errors, at the cost of detection efficiency. 
High gate pulse voltage is also required to obtain large signal amplitude by 
increasing avalanche gain. Impedance matching helps to reduce the spikes to 
some extent [107]. Bethune and Risk have introduced a coaxial cable reflec- 
tion line to cancel the spikes[108]. A unique observation has been made by 
Yoshizawa, et al. that photon detection changes the shape of the charge out 
spike. This change was shown to be useful for high speed photon detection. 
Tomita and Nakamura[109] reported a much simpler method: canceling the 
spikes by taking the balanced output of the two APDs required for the qubit 
discrimination. We describe the detail of the balanced APD photon detector 
in the following. 

Figure 10 depicts the schematic of the SPD. Two APDs (Epitaxx EPM239BA) 
and load resisters were cooled to between — 133°C and — 60°C by an electric 
refrigerator. Short gate pulses of 2.5 V p-p and 750 ps duration were applied 
to the APDs after being combined with DC bias by Bias- Tees. The output 
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Fig. 10. Schematic of the photon detector. HJ and DISC stand for a hybrid junction, 
and discriminators. 
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Fig. 11. Cancellation of the transient spike. Thin solid: APD 1, Dots: APD 2, Thick 
solid: the differential output of the APD 1 and the APD 2. 

signals from the APDs were subtracted by a 180° hybrid junction of 2-2000 
MHz bandwidth. The differential signal was amplified and discriminated by 
two discriminators. Since the spikes were the common mode input for the 180° 
hybrid junction, they would not appear at the output. The APD 1 provided 
negative signal pulses at the output, while the APD 2 provided positive pulses. 
One can determine which APD detects a photon from the sign of the output 
signals. Figure 11 shows the output signal of the amplifier without photon 
input. Almost identical I-V characteristics of the APDs enabled us to obtain 
a good suppression of the spikes. The lowest dark count probability of 7xl0~ 7 
per pulse with detection efficiency of 11 % at -96 °C has been observed. The 
ratio Pd/v was as small as 6xl0 -6 , which corresponds to 270 km QKD trans- 
mission with an ideal photon source. The detection efficiency and the dark 
count probability are increasing functions of the bias. The maximum value of 
the detection efficiency is obtained when the DC bias is set to the break down 
voltage. Larger values of the maximum detection efficiency were observed at 
higher temperatures: the detection efficiency of 20 % at -60 °C with the dark 
count probability of 3xl0~ 5 per pulse. Afterpulse probability was measured 
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by applying two successive gate pulses to the APDs. Afterpulse is prominent 
at low temperatures. Afterpulse probability remained about 10~ 4 for the 1 
/j,s pulse interval at the temperatures higher than -96 °C. This corresponds 
to 1CT 5 error probability (per pulse) for 10 % detection efficiency Based on 
the observation on the dark count probability and the afterpulse probability, 
we conclude that the optimal operation temperature for the present APDs is 
around -96 °C. The obtained afterpulse effect was shorter than the previous 
reports. This is probably due to the decrease of the gate pulse voltage. This is 
another advantage of the present SPDs. Recently, the dark count probability 
has been reduced to 2xlCT 7 per pulse at the detection efficiency of 10 %[110]. 
The S/N, or the ratio Pd/f] is improved about 50 times (17 dB) as much as 
the values previously reported. 



3.2.2 Implementation of BB84 protocol 

We first need to determine how to implement qubits to realize a protocol. 
Polarization is one of the straightforward way, because of the direct corre- 
spondence between the Bloch sphere for a spin-1/2 state and the Poincare 
sphere for the photon polarization state. The four states used in BB84 proto- 
col are given by 
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where \H), \V), \F), and IS*) denote the horizontal, vertical, 45°, and 135° 
polarized states, respectively. We can choose the polarization states arbitrarily 
as long as (0|1) = <0|T> = and |(0|0)| 2 = |(0|1)| 2 = |(1|0)| 2 = |(1|1)| 2 = 1/2. 
For example, the circular polarization states \L) and \R) will work; the BB84 
protocol can be implemented with two of the three basis sets , | V)}, 
{\F) , \ S)}, and {\L} , \R)}. As stated before, practical systems employ weak 
coherent light in place of a single photon. Polarization states of the coherent 
state light are given by 
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where the horizontally (vertically) polarized coherent state \at) H r V *, is expressed 
by the number states as 

2 00 n, n 

\ a ) H (V) = e 2 l^ZJ \ n )H(V) ( 184 ) 
n=0 U - 

The 45° polarized coherent state is reduced to a superposition of single photon 
states in the weak light limit (a <C 1): 

\F) coh « \vac) + ^(\H) + \V)) + 0(a 2 ) (185) 

Similar expression holds for the 135° polarized coherent state. Therefore, the 
weak coherent states (183) can approximate the four single photon states 
(182), when we neglect the vacuum states by postselection. This observation 
rationalizes the use of weak coherent states in the QKD systems. 

The above polarization encoding is often employed in QKD systems for free- 
space transmission. However, the polarization encoding is not suitable for fiber 
transmission, because the polarization states fluctuate in fibers by the effects 
of environment: birefringence induced by stress, and polarization rotation by 
the geometric phase in twisted fibers. Nevertheless, it should be noted that 
the polarization coding may be still usable if we compensate the polarization 
changes after the transmission. This is due to the fact that the polarization 
fluctuation in the installed changes slow (in minutes or hours), and intermit- 
tent control with strong reference light will keep the polarization states. 

The alternate coding is phase coding. Suppose a Mach-Zehnder interferometer 
(MZI) as shown in Fig. 12(a). The amplitude of the photon is divided equally 
into the two arms of the interferometer (path P and path Q). Alice can prepare 
the four states for BB84 protocol by modulating the phase of the amplitude 
in one arm by one of the four values: <pA = {0°, 180°}, and {90°, 270°}. The 
modulation results in 



|0} = -^(|P> + |Q» 
|1>~(|P)-|Q» 

\0} = ^=(\P}+^\Q}) 

\l) = ^(\P)-i\Q)), (186) 

where the wavefunction \P) (\Q)) represents the state that a single photon 
exists in the path P (Q). The states given in Eq. (186) are equivalent to 
the states {\F) , \S) , \L) , |-R)}. Phase modulation in Bob's station refers to 
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Fig. 12. A Mach-Zehnder interferometer set-up for implementing BB84 protocol with 
phase coding, (a): Basic scheme (b): Scheme consists of two asymmetric Mach-Zehn- 
der interferometers and a single transmission channel (c) Plug and play system using 
a Faraday mirror for self-compensation 

the basis selection. Bob obtains the correct bit values, when the difference 
between the phase modulations satisfies 4>a — <Pb = 0°, or 180°. 

MZI shown in Fig. 12(a) is however impractical, because it requires two fibers. 
Besides the economical reasons, the interferometer is sensitive to disturbance, 
because the photons in the different paths experience the independent fluctu- 
ations. A time division interferometer, which requires only one common fiber 
for transmission as shown in Fig. 12(b), will be more stable. Alice's asymmetric 
Mach-Zehnder interferometer (AMZ) divide the amplitude into double pulse, 
where one component passed through the shorter arm, and the other through 
the longer arm. Modulation of the relative phase between the pulse component 
results in the four states (186). After passing Bob's AMZ, the pulse contains 
three components. The first component originates from the amplitude that 
passed through the shorter arms in both interferometers. The middle com- 
ponent results from the two contributions: the shorter arm in Alice and the 
longer arm in Bob, and vice versa. The last component originates from the 
longer arms in both. Only the middle component shows interference, and con- 
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tributes to the key transmission. Photon detection probabilities are 1/4, 1/2, 
and 1/4 for the first, middle, and last components. Therefore, the time divi- 
sion system loses a half of the transmitted photons. This time division phase 
coding was first implemented by Townsend et al [111] for QKD systems. They 
observed a clear interferometric fringe after the transmission in the fiber of 10 
km-30 km long. The time division QKD system requires precise control of the 
path length. The two interferometers of Alice and Bob should be identical to 
obtain a high visibility. The path difference should be kept within 3 % of the 
wavelength to maintain the visibility higher than 0.98. 

A simple method has been proposed to achieve stable interference without 
complicated active stabilization. This method, called 'Plug and Play' (P&P) [112], 
utilizes folded interferometer as shown in Fig. 12(c). Original proposal used 
three Faraday mirrors (FM)[113], but the simplified scheme works with one 
FM[114]. This scheme combines the time division and polarization division 
interference. The output of the laser is divided into two arms by beam splitter 
(BS). The one arm is set to be longer than the other. The outputs of the two 
arms are combined by polarization beam splitter (PBS) after the polarization 
rotation in one arm by 90°. The transmitted light is reflected by the FM and 
phase modulation is applied to one of the time divided components. The light 
is sent back to Bob after attenuation to the single photon level. PBS divides 
the light into the two arms. Since the polarization is rotated 90° by FM, the 
light component passed through the shorter arm in the outward transmission 
goes to the longer arm in the homeward transmission, and vice versa. The 
use of common AMZ guarantees the condition for the interference automati- 
cally. Moreover, the P&P scheme is robust to the disturbance during the fiber 
transmission. To see this, we examine the role of the FM in P&P systems. 
Since the reflected light propagates in the opposite direction, we need to be 
careful about the coordinate. Here we fix the direction of axes in the labora- 
tory. The effect of FM in linear polarization basis reads a x rotation. The effect 
of transmission line (fiber) on the polarization can be expressed by a unitary 
transform: 



respectively. The above unitary transform (187) is general, as long as we can 
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and the rotation on z axis 




(189) 



62 



neglect depolarizing in the fiber. We can see that the total effect (not include 
global phase) of going- around the transmission line is just the transformation 
by the FM 

R z {26) R y {2 1 )R z {2(3) a x R z {2(3) R y {2 1 )R z {26) = a x . (190) 

Eq. (190) implies that the outward and homeward polarizations are orthog- 
onal, regardless of the disturbance at the transmission line and the initial 
polarization. This condition is essential for stable interference. Combination 
of an ordinary mirror and a quarter wave plate will rotate the polarization. 
However, this combination does not work for auto-compensation, because its 
effect is described by R y {n) ^ a x . Even with FMs, the autocompensation be- 
comes no longer perfect, if the transformation by the FM deviates from a x . 
Since the refractive index in materials depends on temperature, the rotation 
in FMs is no longer equal to 90° as sifting temperature. It has been shown 
the combination of a phase modulation and a polarization rotation in a loop 
mirror yields a x [115]. Temperature dependence can be easily compensated by 
changing apply voltage to the phase modulator, so that stable operation in 
a wide temperature range (from — 5°C to 75°C) has been obtained. It should 
be noted that we assume the disturbance in the homeward transmission is 
identical to the outward transmission. We see this assumption reasonable, 
considering the fact that the round trip time is shorter (about 1 /xs/km) than 
the time constant of the disturbance in the fiber (more than 1 s). 

3.2.3 Plug & Play System 

Most of the successful QKD transmission experiments have been based on so 
called Plug-and-Play (P&P) system, which contains autocompensation mech- 
anism to achieve good interference performance with ease[116]. In P&P sys- 
tems, the light source and the photon detectors are in the same side of the line; 
the pulses travel first from Bob to Alice, and then back to Bob. Back-scattered 
light will degrade the signal-to-noise ratio. The back-scattering is unavoidable 
due to non-uniformity in a fiber. The connections in practical fiber network 
will cause considerable reflection. Therefore, burst mode operation is necessary 
in practical P&P systems, where a storage line is installed in Alice's station, 
and the length of the pulse train is set to be smaller than the storage line. 
The backward light will never cross the bright light in the transmission line. 

Currently, two P&P systems have appeared on market[117,118]. QKD experi- 
ments on installed fibers have been also reported. One is the transmission over 
67 km done by the group of Geneva University [116]. They reported a success- 
ful key exchange at raw rate of 160 Hz with 5 % QBER through a 67.1 km 
fiber from Geneva to Lausanne installed under the lake, where the measured 
fiber loss was 14.4 dB. Average photon density was set 0.2 photons/pulse in 
this experiment. Recently, Hasegawa et al[119], have reported key exchange 
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over 64 km and 96 km fiber transmission test-bed (JGNII). The fiber loss in 64 
km single mode fiber was 13.29 dB. They could exchange key at 21.5 bps with 
4.7 % QBER for 64 km transmission and 8.2 bps with 9.9 % QBER for 96 km 
transmission, respectively. The clock frequency of the system was 1 MHz, and 
average photon number was 0.1 photons/pulse. The fiber cable in the test bed 
contained ten cores, so that they used one core for quantum communication 
and another core for clock distribution. 

So far, the transmission experiments were done in fairly stable environments, 
even in the installed fibers, the fibers were buried under the lake or well- 
maintained as a test-bed. In commercial fiber networks, which contain many 
connections and reflecting points, the loss and the back-scattering differ fiber 
to fiber. Access links for end-users sometimes use the fibers installed in the 
open-air. The fibers may experience mechanical vibration and temperature 
fluctuation. The system for quantum communications should be designed to 
be stable against the fluctuation of the environment. The QKD systems should 
have a clock synchronization system, which can trace the shift of fiber length 
due to thermal expansion and keep the optimum timing. A watch-dog sys- 
tem is also necessary to monitor key generation rate and error rate, and the 
transmission system should automatically re-set and calibrate itself on system 
errors. A QKD system fully equipped with the above functions has been devel- 
oped. A 'hands-free' transmission was achieved through a 16 km commercial 
fiber link installed on electric poles with the system for fourteen days with the 
final key rate of 13 kbps[120]. 



3.2.4 one-way transmission 

Although the P&P system works well for QKD systems using a weak pulse 
up to 100 km [110], extending the transmission distance will be difficult even 
if a lower noise SPD is developed. This is because backscattering noise in 
the fiber dominates the detector noise, which is intrinsic to the bidirectional 
autocompensating system. Although the use of storage line and burst photon 
trains would reduce the backscattering, this would also reduce the effective 
transmission rate by one-third. 

Unidirectional systems are free from the above problems. Such systems have 
also an advantage that they are compatible with photon sources of true single 
photons or quantum correlated photon pairs, which are believed to provide 
higher key rate after a long distance transmission. The difficulty in the uni- 
directional system has been the stabilization of two remote interferometers to 
achieve high visibility. The system should solve the conflict between stability 
and transmission distance. Recently, three systems have been reported that 
overcome such difficulty One system employs an active control using fiber 
stretcher. The system performed a 122 km fiber transmission with QBER of 
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Fig. 13. Schematics of the integrated-optic interferometer system for quantum key 
distribution. LD: laser diode, ATT: attenuator, APD: avalanche photodiode, DS: 
discriminator, CT: counter, H: 180° hybrid junction. 

8.9 %[121] and a continuous quantum key distribution session of 19 hours 
over a 20.3km installed telecom fiber [122]. In the latter experiment strong ref- 
erence pulses were sent between the quantum signals for the active control. 
Another system installs an automatic compensation on polarization fluctua- 
tion by Faraday mirrors in the Michelson interferometers at the both sites. A 
125 km QKD transmission from Beijin to Tianjin has been reported [123]. The 
third solution is to use an integrated-optic interferometers based on planar 
lightwave circuit (PLC) technology [124]. The PLC technology provides a sta- 
ble interference with a simple setting. The longest distance transmission over 
a 150 km fiber has been achieved[125]. The detail of the PLC system will be 
described in the following. 

The interferometers, asymmetric Mach-Zehnder Interferometers (AMZs) with 
a 5-ns delay in one of the arms were fabricated on a silica-based PLC plat- 
form. Since the AMZs were fabricated using the same mask, they had the 
same path length difference between the two arms. The optical loss was 2 
dB (excluding the 3-dB intrinsic loss at the coupler). Polarization-dependent 
loss was negligible (0.32 dB). One of the couplers was made asymmetric to 
compensate for the difference in the optical loss between the two arms, so the 
device was effectively symmetric. A Peltier cooler attached to the back of the 
substrate enabled control of the device temperature with up to 0.01 °C preci- 
sion. Polarization-maintaining fiber (PMF) pigtails aligned to the waveguide 
optic-axis were connected to the input and output of the AMZ. 

Two AMZs were connected in series by optical fiber to produce a QKD inter- 
ferometer system (Fig. 13). Optical pulses that were 200 ps long and linearly 
polarized along one of the two optic-axes were introduced into the PMF pig- 
tail of Alice's AMZ from a DFB laser atl550 nm. The input pulse was divided 
into two coherent output pulses polarized along the optic-axis of the output 
PMF, one passing through the short arm and the other through the long arm. 
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Fig. 14. Photon counting probability against transmission distance. Open triangles 
indicate the results in the P&P system. Inset: Fringe observed in photon count rate, 
obtained by changing the device temperature at 150 km. 

The two optical pulses were attenuated to the average photon number of 0.2. 
The two weak pulses propagated along the optical fiber and experience the 
same polarization transformation. This is because the polarization in fibers 
fluctuates much slower than the temporal separation between the two pulses. 
After traveling through Bob's AMZ, these pulses created three pulses in each 
of the two output ports. Among these three pulses, the middle presents the 
relative phase between the two pulses. The interfering signal at the middle 
pulses was discriminated by adjusting the applied gate pulse timing. The sys- 
tem repetition rate was 1 MHz to avoid APD after-pulsing. 

Precise control of the relative phase setting between the two AMZs and the 
birefringence in the two arms of Bob's AMZ are necessary to obtain high vis- 
ibility. Both can be done by controlling the device temperatures. To set the 
phase, it is sufficient to control the path length difference within AL = X/n, 
where n ~ 1.5 is the refractive index of silica. The path length difference de- 
pends linearly on the device temperature with 5 /xm/K, due to the thermal 
expansion of the Si substrate. The birefringence in the two arms can be bal- 
anced by controlling the relative phase shift between two polarization modes, 
because the two arms have the same well-defined optic-axes on the substrate. 
If the path length difference is a multiple of the beat length ALb = A/ An, 
where An is the modal birefringence, the birefringence in the two arms is bal- 
anced and two pulses interfere at the output coupler of Bob's AMZ no matter 
what the input pulse polarization is. Since An/n was the order of 0.01 for our 
device, the birefringence was much less sensitive to the device temperature 
than the relative phase. Therefore, we could easily manage both the phase 
setting and the birefringence balancing simultaneously. 

The photon counting probability given by the key generation rate divided by 
the system repetition rate is plotted as a function of transmission distance 
(Fig. 14). The measured data fit well with the upper limit determined by the 
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loss of the fiber used ( 0.22 dB/km). In Fig. 14, the base lines present the dark 
count probabilities. The interference fringe is shown in the inset. The visibility 
at 150 km was 82 % and 84 % for the two APDs[125], which corresponds to a 
quantum bit error rate (QBER) of 9 % and 8 %, respectively. These satisfy the 
rule-of-thumb for secure QKD. The interference was stable for over an hour, 
which is good enough for a QKD system. The present system could achieve a 
much longer transmission distance than was attained in a previous experiment 
using the autocompensating system. The PLC system was shown to be stable 
for more than three hours with only the temperature control at each local site. 

A similar QKD implemmentation has been proposed to keep security over 146 
km fiber transmission by using strong reference light [126]. 

3.3 Eavesdropping and security 

3.3.1 Attacks to weak coherent light BB84 

As we have observed, weak coherent states will work as a good approximation 
of single photon states. Nevertheless, coherent state pulses may contain multi- 
photon with small but non-negligible probability. The multi-photon states 
would give Eve an opportunity to obtain more information on the transmit- 
ted photon states than the single photon states. Two approaches have analyzed 
the security of the weak coherent light BB84 protocol. One assumes that any 
multi-photon state will provide the full information on the photon states, and 
tries to limit the probability of multi-photon states. This approach will yield 
the upper bound of the Eve's information and the conation of the uncondi- 
tional security against all the possible attacks allowed by the laws of quantum 
mechanics. The other approach limits Eve's attack (often to the individual 
attacks) and estimates Eve's information for each attack[105]. This approach 
will provide the security conditions useful to design practical QKD systems. 
We here concentrate ourselves to the latter approach. The former approach 
will be discussed in the following chapter. 

Our assumptions in the present analysis are the following: 

• Weak Coherent Light: QKD system uses coherent light whose average pho- 
ton number per pulse is set less than one. The photon state may not be 
coherent state, as long as the photon number distribution obeys Poisson 
distribution. It will make the analysis easier to assume no phase correlation 
between the pulses. This assumption also prevents Eve to perform coherent 
attacks. 

• Individual Attack: Eve measures one qubit at a time. Eve can store a qubit 
in a quantum memory till useful information is disclosed. Eve can also store 
the measurement results in conventional memories to analyze the results 
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statistically. The assumption of individual attack implies that the informa- 
tion obtained by the measurement on n qubits equals to the n times the 
information obtained by the measurement on one qubit. 

• No PNS: As we shall show it later, decoy states can detect a eavesdropping 
that alters the photon number distribution. Therefore, we don't have to 
worry about photon number splitting (PNS) attack[127,128], though it is a 
very strong eavesdropping method. 

• No control on Bob's equipment: Eve cannot control the performance of Bob's 
equipment. For example, Eve cannot change the dark count probability in 
Bob's photon detector. Eavesdropping affects the error rate originated in 
the transmission line. As a result, Eve's information on the key depends 
only on the error rate due to the imperfection of the transmission. Errors 
from the dark count only reduce the mutual information between Alice and 
Bob. 

Eve tries to get the information by the optimal measurement under the above 
conditions. We will not assume no further restriction on Eve's ability. Some 
of Eve's ability may seem too good in the real situation. For example, Eve 
can replace the lossy fibers by lossless ones. Eve can measure the photon 
number contained in a pulse, and determine the optimal measurement. If we 
would stick with realistic eavesdropping under current technology, margin of 
the security would be much increased. However, this too limited approach 
may lose the advantage of QKD that guarantees the security whatever the 
technology may be developed. 

Eve can improve her measurement with the classical information exchanged 
between Alice and Bob. Some information on the key bit are also announced. 
Security analysis should consider the information leakage. The classical infor- 
mation leakage in each step in the protocol is following: 

• Bob show the position of the bits that he detected. Eve knows the position 
of the working bit, but obtains no information on the states. 

• All the basis are disclosed in sifting. Eve can measure the stored qubits with 
the optimal setting with the basis information. 

• In error rate estimation, some bit values are open. It makes no harm, how- 
ever, because they are never used for cipher. 

• Partial information on bit values, parity of several bits, for example, are 
exchanged to detect and correct errors. 

The simplest eavesdropping method is so called absorption-resend attack, 
where Eve measures the photon state and prepares the photon state to send 
Bob according to her measurement. Curty and Lutkenhaus[129,130] exam- 
ined the attack for coherent light. As discussed for single photon, however, 
the absorption-resend attack is not optimal. The optimal individual attack 
for single photon state is given by cloning[131]. Eve sets her cloning machine 
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to interact her qubit (ancilla) with the qubit sent by Alice and measure the 
ancilla to obtain the bit value. Eve may store the ancilla till the basis are 
open in the sifting. Eve can measure photon number in a pulse to prepare her 
cloning machine to be optimal. The photon number is in a different degree of 
freedom from that represents the qubits, so that photon number measurement 
doesnot affect the qubit. 

In BB84, the four qubit states stay in a circle of the Bloch sphere. The optimal 
asymmetric cloning machine for these equatorial qubits is given for a single 
photon state, but is not known for n photon state. We will consider a universal 
cloning machine here, which is suboptimal but the gap is expected to be 
small [132, 129]. Note that the cloning machine should be universal, because 
Eve doesnot know the basis when she applies the machine. A n — > n + 1 
Asymmetric universal cloning machine is given by a unitary transform U as 
follows: 



Eve forwards the first n particles and keeps two particles. Disturbance D to 
the qubits sent to Bob is given by D = 2 ft 2 . The coefficients a and /3 satisfy 



In Eq. (191), &k is a superposition of the operations that applies a Pauli 
operator o^{\k = x, y, z) to one of the n particles.; 



a k = a™ ® l( 2 > ® ■ ■ • ® lW + ■ ■ ■ + 1« ® ■ • • ® l^- 1 ) ® a£ n) . (193) 



This cloning machine is universal, because the result (191) is independent of 
the input particle state \<f>). It is also optimal, in the sense that it yield the 
fidelity F = (n 2 + 3n + 1) / (n 2 + 3n + 2) for the optimal universals cloning 
machine given by Gisin and Massar[133], when we assume identical fidelity for 
the first n + 1 particles. However, it is not optimal as an n — >• n + 2 cloning 
machine, though it uses two ancilla, because the fidelity of the last qubit is 
less than the optimal value. 

Eve's error rate on the key is estimated from the distance between Eve's 
reduced density matrices as 




(191) 



a 2 + n{n + 2)(3 2 = 1. 



(192) 



E (n) 



1 - 



(194) 



2 



where the distance can be measured by the fidelity: 




(195) 
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The reduced density matrix p^ is obtained by tracing out Bob's states from 
U \(f)f n |00) (00| (<j)f n W for each Alice's state \<f>) = |0), |1), |0), |1). Since Eve 
knows the basis when she measures the qubits, she needs to distinguish p^ 
from p$ or p$ from p:™). 

So far, we assume that Eve has an excellent technology to make an optimal 
cloning machine. Now Suppose Eve has a magic fiber that can transmit a pho- 
ton without loss[134]. She can replace the fiber between Alice and Bob by 
her magic fiber and put a beam splitter before the fiber without any change 
in Bob's detection rate, if she set the transmittance T of the beam splitter 
equal to the inverse of the fiber loss. A photon will be detected by either Eve 
or Bob. Since Eve's detection does not correlated with Bob's, Eve will not 
gain any information, if a single photon was sent. However, coherent state 
light provide a finite probability that Bob and Eve detect a photon at the 
same time. If Eve keep the photon until the basis is open, she will obtain 
full information on the photon by measuring it according to the basis. The 
conditional probability of Eve's detection on the photons that Bob detected 
is given by Pes — (1 — exp[— Rp]), where R = 1 — T. This expression is the 
same as Eve's detection probability itself, because the Eve's detection process 
is independent of Bob's. The mutual information between Bob and Eve on the 
key bit therefore reads 

Ibe = Pes- (196) 

It is possible to apply the optimal cloning attack on the output light of the 
beam splitter. This combined attack may be the strongest among the individ- 
ual attacks. Fig. 15 show the mutual information I^b and /be as a function of 
transmission distance, where the parameters are taken from the recent experi- 
ments for (a) long distance [125] (b) short distance but high speed transmission 
[115], as follows: the fiber loss a = 0.22 dB/km, the receiver loss (3 = 5 dB, 
dark count probability Pd = 2 x 10~ 7 /pulse, average photon number p = 0.2, 
visibility of the interference v = 0.96 in 150 km transmission, and a = 0.25 
dB/km, (3 = 1.5 dB, P d = 1 x 10~ 4 , p = 0.6, v = 0.995 in 40 km transmission 
at raw key rate of 100 kbps, respectively. Visibility is usually a measure of 
the quality of the interferometer, but it is also a measure of the disturbance 
by eavesdropping in QKD experiments, where the disturbance D is given by 
D = 1 — v. Impact of the parameters Pd, D, and p is following. Dark counts, 
which result in Bob's error, reduce the mutual information Iab- Disturbance 
increases Eve's information obtained by the cloning attack. Increasing average 
photon number raise the probability that the pulse contains more than two 
photons. Eve can obtain more information by the beam splitter attack. As 
shown in Fig. , the mutual information between Alice and Bob is larger than 
that between Alice and Eve with the present parameters. The results implies 
that the we can extract secure final keys from the transmitted raw keys in the 
experiments [115,125]. 
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Fig. 15. Mutual information Iab and I be as a function of transmission distance. 
(a)the parameters are taken from the long distance transmission experiment [125]: 
a = 0.22dB/km, (3 = 5dB, P d = 2 x 1(T 7 , // = 0.2, v = 0.96. (b) the parameters 
are taken from the short distance but high speed transmission experiment [115]: 
a = 0.25 dB/km, = 1.5 dB, P d =lx 10~ 4 , a = 0.6, v = 0.995P 

3.4 Ideas of unconditional security proof 



We have studied some typical types of Eavesdropping. However, the study 
of some types Eavesdropping itself does not make an unconditional security 
proof, because Eve may have many other choices. A security proof should 
not be dependent on any assumption that restrict Eve's actions which do not 
violate laws of nature. Here we show some ideas of the security proof. Detais 
are presented in the next section. 

Since Bennett and Brassard proposed the first quantum key distribution pro- 
tocol, the proof of the security has been one of the main issues. Several authors 
have presented the proof of the unconditional security assuming a single pho- 
ton source. It has been clarified that the role of the quantum mechanics is to 
set a bound to Eve's knowledge on key. 

Suppose Alice and Bob share a random variable W (n bits). Eve tries to know 
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the random bits without being detected. If Eve's knowledge V about W is at 
most t < n: Renyi entropy is bounded by, i?(W|V = v) > n — t, Alice and 
Bob can distill r = n — t — s bits of secure key K, Eve's mutual information 
on which satisfies [135,136,137] 



I(K;GV) = ^, (197) 



with a random choice of universal hash function G as K = G(W). However, it 
is unknown so far whether the conclusion here for classical communication also 
allpies for quantum case. Since in QKD, Eve may choose to store her ancillas 
first and then directly attack the final key after the privacy aplification stage 
taken by Alice and Bob. 

The first unconditional security proof is completed by Mayers which is based 
on the uncertainty principle and classical error correction code (CSS code). 
As a result of Mayers' proof, Eve's information about the final key shared 
by Alice and Bob must be exponentially close to 0, given whatever type of 
attacking schemes she may take. Mayers proof is rather complex. 

Shor and Preskill[138] simplified Mayers' proof from the viewpoint of (virtual) 
entanglement distillation [137]. Since entanglement purification is equivalent to 
quantum error correction(QEC), Alice and Bob can share nearly maximally 
entangled pure states from degraded entangled photon pairs by performing 
QEC on their sites. Shor and Preskill have shown that the entanglement pu- 
rification protocol can be reduced to BB84 protocol by the following steps. 
The entangled photon source can be in Alice's site. Suppose Alice measures 
one of the photon pair before Bob. The photon state sent to Bob is same as 
a single photon state modulated according to a random number, which cor- 
responds to Alice's measurement result. In this protocol, Alice sends random 
qubits encoded in a random quantum code, and Bob obtains bit values after 
performing QEC. The quantum code can be CSS code, so that this protocol 
is called CSS code protocol. Bob measures qubits on the computational basis 
{X,Z}, and phase does not affect the measurement results. Therefore, QEC 
in the protocol needs not to correct phase errors. Since measurement and QEC 
can commute, i.e., Bob can measure the qubits first and then correct errors 
by a classical code corresponding to the CSS code. This protocol is nothing 
but BB84. Performance of QEC would determine the limit of error rate to 
guarantee the security. The limit, however, will never exceed 25 %, where the 
entanglement between Alice and Bob can no longer be recovered. The security 
of QKD with an imperfect source is then also shown. 
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4 Security proofs and protocols of QKD with weak and strong 
Gaussian states 

This section contains the security proofs and protocols of QKD with real se- 
tups. We shall first review the entanglement purification protocol given by 
Bennett, DiVincenzo, Smolin and Wooters[139] (the BDSW protocol) and 
then reduce it to the security proof of BB84 QKD protocol with perfect 
single-photon source which is a difficult technique. There are a number of 
useful methods for secure QKD directly using laser light, e.g., the decoy-state 
protocol[140,141,142], the SARG04 protocol [143], the protocol with strong 
reference light [144] and the protocol with bright squeezed light [145]. In this 
section, we shall go into some of them after the security proof of standard 
BB84 protocol with ideal source. 



4-1 Entanglement purification and security proof of QKD 

The first security proof of BB84 protocol is given by Mayers [135]. The secu- 
rity proof for QKD can be simplified if Alice and Bob have large quantum 
computers[137]. Later, Mayers' security proof of BB84 protocol was simplified 
by Shor and Preskill [138] based on the simple idea of first doing entanglement 
purification with a CSS code[138,75] and then reducing it to a prepare-and- 
measure protocol (BB84) and distilling the data of measurement outcome by a 
classical CSS code. An excellent tutorial of Shor and Preskill's proof has been 
presented by Gottesman and Preskill [145]. Here we modify Shor and Preskill's 
proof and we present an alternative approach which is based on the idea of 
the (modified) BDSW entanglement purification protocol [139]. By using our 
modified proof, the problems such as how to construct a CSS code or the 
existence of good CSS codes is circuvemented[146]. (Mayers' proof does not 
have these problems but it is rather complex.) 

The first work to relate the security of QKD with quantum entanglement was 
published in 1991 [147]. It was then found that actually one can use the idea 
of quantum entanglement as a mathematical tool to prove the unconditional 
security. If Alice and Bob share a number of perfect EPR pairs, they can 
measure them at each side in Z basis ({|0), |1)}) and use the measurement 
outcome as the shared secure key. Say, outcome |0) for bit value and |1) for 
bit value 1. This key will be perfect and no third party can have any informa- 
tion about it. If the pre-shared EPR pairs are almost perfect (exponentially 
close to the perfect ones), they can also use the measurement outcome as the 
secure key since any third party's information about the key is exponentially 
close to 0[137]. If the pre-shared pairs are noisy but not too noisy, they can 
first purify them into a smaller number of almost perfect pairs which are expo- 
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nentially close to perfect pairs and then obtain the secure final key. This is the 
entanglement-purification-based protocol. We shall use the modified BDSW 
protocol [139] for the entanglement purification and then show how to reduce 
it to a prepare-and-measure one[138,145]. 



4-1.1 Main idea of entanglement purification 

Suppose initially Alice and Bob share N + m raw pairs and each pair is in 
one of the 4 Bell states. The goal of entanglement purification is to distill out 
K < N pairs which are all in the Bell state of \<p + ). We can reach such a goal 
if most of the initially shared raw pairs are in |0 + )[139]. To reach the goal, 
we need first to know the error rate of the raw pairs and then we can locate 
the wrong pairs by hashing. By local bit-flip or phase-flip operations, all the 
outcome pairs will be in state with a probability exponentially close to 
1. The original BDSW protocol[139] requests that each of the raw pairs must 
be in one of the 4 Bell states, i.e., there is no entanglement among different 
pairs. It is then shown by Lo and Chau[137] that actually the result of BDSW 
is unconditionally correct given what ever initial state of the raw pairs. This 
makes the base of the unconditional security of QKD. There are 2 main steps: 
error test and hashing. 



4-1.2 Error test 

The initial N+m shared raw pairs can be in any state, e.g., there could be com- 
plex entanglement among different pairs. But here our task is not to know the 
state of these pairs. We imagine that each shared raw pair is measured in the 
Bell basis in the beginning but no one reads the measurement outcome[145]. 
(As shown later, the fidelity result of purification keeps unchanged if this vir- 
tual Bell measurement in the beginning is omitted.) Therefore each pair is 
now in one of the 4 Bell states and our task is to locate wrong pairs, those 
pairs which are not in state The goal of error test is to see how many 

pairs are bit-flipped (i.e., in state \ip + ) or state and how many of them 

are phase-flipped (i.e., in the state or state |^ - ))- 

We use notations |0), |1) for the eigenstates of operator Z with eigenvalues 
0,1, |0) = ^=(|0) + |1)), |1) = ^g(|0) - |1)) for the eigenstates of operator 
X with eigenvalues 0, 1, and Za®b for the basis of collective measurement of 
parity value in Z basis for a pair. Given any state a\a) a\o) b + /3\a®l) ^©l) b , 
the measurement outcome in Za®b basis will be za®b = a ® b. If Alice and 
Bob do individual measurement at each side in Z basis, there would be two 
outcome, za and zb at each side and we have 

z A ®z B = z a ®b- (198) 
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Remark: Throughout this section, all summation symbols are for the bit wise 
summation, i.e., a®b = Qiia = b and a ®b = 1 if a ^ b. 
Similarly, we can also denote the parity measurement in X basis by Xa®b and 
its measurement outcome is 

xa®b = xa®x b . (199) 



The first question here is how the principles of classical statistics works for 
a quantum system as stated in Ref. [137]. Since Za®b and Xa®b commute, 
one can in principle measure any pair in both Za®b and Xa®b- A pair carries 
a bit-flip error if za@b = 1, a phase-flip error if %a@b = 1- Given N + m 
raw pairs, we can randomly choose m pairs as test pairs. We want to know 
the error rates (including bit-flip rate and phase-flip rate) of the remaining N 
pairs by examining the m test pairs. This is called the error test. 

Since Xa®b and Za®b commute, we can imagine that we had first measured 
each of the m test pairs in both bases and then estimate the error rates of the 
remaining N pairs by examining the measurement outcome of m test pairs. 
Further, we can divide the m test pairs into two subsets and each subset con- 
tains m/2 pairs. We can measure each pair in the first subset in basis Za®b to 
see the bit-flip rate and measure each pair in the second subset in Xa®b basis 
to see the phase-flip rate. If m is very large, the error rates obtained in this way 
must be the same with the error rates obtained by measuring each test pair 
in both Za®b basis and Xa®b basis. Therefore, after measuring one subset of 
the test pairs in Za®b basis only and the other subset in Xa®b basis only, one 
can estimate the (upper bound) values of both bit-flip rate and phase-flip rate 
of the remaining N pairs if these pairs were measured. Since the Bell measure- 
ment and collective measurement Za®b or ^a®b commute, the operation of " 
Bell measurement plus Za®b (Xa®>b)" wm gi ye the same outcome of bit-flip 
rate (phase-flip rate) with that of the measurement of Za®b (Xa@b)> thus the 
virtual initial Bell measurement to those m test pairs can be omitted. Also, 
since all test pairs are discarded, we can actually use whatever measurement 
to those test pairs provided that the outcome tells us the value of za®b of one 
subset and the value of xa®b for the other subset of the test pairs. Therefore 
we can replace Za®b for the first subset by individual measurements in Z basis 
at each side, and Xa®b for the second subset by individual measurements in 
X basis at each side, because the outcome of individual measurements deter- 
mines the outcome of collective measurements by Eq.(199). Further, it makes 
no difference if Alice measures her halves of those test pairs before entangle- 
ment distribution. This means, instead of sharing m pairs with Bob, she can 
simply send Bob m single qubits with each state being randomly chosen from 
|0), |1) and |0), |1) (i.e., BB84 states) for the future error test. 
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4-1.3 Hashing 



After the error test, Alice and Bob now share N raw pairs. For simplicity, we 
shall assume the non-local measurements Za@b-, ^a®b and controlled-NOT 
gates for Alice and Bob at this moment. However, these are only mathematical 
techniques for the security proof. As shown later, all these assumed (virtual) 
operations are not really necessary and the protocol is reduced to the BB84 
protocol. As assumed earlier in the " error test" part, Alice and Bob had 
measured each of the shared N pairs in the Bell basis but they don't look at 
the measurement outcome[145]. Each pair must now be in one of the 4 Bell 
states. The task is to find out the positions of those pairs which are not in 
\<p + ) and then correct the errors. Given iV raw pairs, we can use two iV— bit 
classical binary strings, the bit- flip string Sb and the phase- flip string s p to 
represent the positions of bit-flips and phase-flips. For any ith pair, if it bears 
a bit-flip error, the ith element in string s& is 1, otherwise it is 0; if it bears 
a phase-flip, the ith element in string s p is 1, otherwise it is 0. For example, 
given 5 pairs the two classical strings are 

s b = 00101; s p = 00011. (200) 

The goal is to detect the positions of those pairs bearing a bit-flip error or 
a phase-flip or both. This goal can be achieved by hashing, which consumes 
some of raw pairs and the shortened bit-flip string and phase-flip string for 
those remaining pairs can be determined. If the bit-flip rate and phase-flip 
rate are bounded by t&, t p h respectively, the number of likely bit-flip string 
and phase-string for N raw pairs are bounded by 

Ub = 2*-m) ]Up = 2 »- H M (201) 

respectively and H(x) = — xlog 2 x — (1 — x) log 2 (l — x). (After the error test, 
the values of for the remaining N pairs are known already.) 

To have a clear picture, we consider the result of classical hashing first. Suppose 
we know that there are uj = 2 n candidates for an unknown N— bit classical 
string. We can determine a shorter sub-string by revealing the parity values 
of n + 5N random subsets of elements from the string. Say, each time we 
reveal the parity value of a random subset and then discard one bit in the 
subset. After we have revealed n + 8N parity values, we examine each likely 
candidates for the remaining string whose length is N — n — SN. There must 
be one candidate string s f satisfying all those revealed parity values. And the 
probability that there is another (different) candidate string that also satisfies 
those parity values is only 2~ SN . Therefore, the string for the remaining bits 
are determined. A detailed proof of this is given in [139]. 

(1) Bit-flip error correction. To use the classical result of hashing here, we only 
need to know how to detect the parity value of any subset of the bit-flip string 
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Sb, i.e., the parity of a shorter bit-flip string for any subset of those N raw pairs. 
This can be done by the so-called biCNOT operations and measurements in 
Za®b basis. 

Suppose there are u pairs in a subset E, E = {ei,e 2 ,--- ,e u } is a subset 
that contains pair ei, e 2 , • • • ,e u . The bit-flip string for this subset is s b (E) = 
c ei c e2 ■ ■ ■ c eu and the bit-flip string of N pairs are Sb = cic 2 ■ ■ ■ cn and N > u, 
of course. We want to know the parity value of string Sb(E), i.e., 

53 Q = C ei © C e2 © • • • © C e „. (202) 

We have the following fact 

53 Q = 5] zakbbi (203) 

Here zai®bi is the outcome data for pair I if it is measured in Za®b basis. 
However, as shown below in obtaining J2i&e c u we do NOT have to know each 
individual value of q. 

A CNOT gate in Z basis is a gate that takes the following transformation: 

|*i)|2 2 ) — > \z 1 )\z 1 @z 2 ). (204) 

Here the first state is the control state, the second state is the target state, 
z±,Z2 can be any value from {0,1}. A biCNOT gate contains two CNOT 
gate, one in Alice's side the other in Bob's side. Explicitly, we first denote 
10"), by |xoo), Ixoi), Ixio), Ixn), respectively. That is to say, 

for any pair state \xb, P h), the parity value za^b = b, xa®b = ph. Given two 
pair state \xbi,phi) \Xb 2 ,ph 2 )y if we do a biCNOT in Z basis on these two pairs 
with the second pair being the target, we have 

hiCNOTz(\xbi,phi)\Xb2,ph2)) = \Xb 1 , P h 1 ® P h 2 )\Xb i©&2 , P h 2 

). (205) 

This means, a biCNOT operation will collect the parity value zai®bi®za2®B2 = 
b\ © b 2 into the target pair. Given Eq.(205), we can know the parity of string 
Sb(E) by the following way: 1. Gather J2i^e z ai+bi into pair d G E by per- 
forming biCNOT gates between pair d and other pairs in set E, with pair d 
being the target pair. 2. Measure pair d in basis Za@b- 3. Discard pair d. For 
example, to know the parity of bit-flip substring Sb(E) = C!C 4 c 5 , they can first 
do biCNOT operations in Z basis as shown in Fig. 16, then measure pair 5 in 
basis Za®b and then discard pair 5. 

They repeat this for q = NH(tb) times and Bob can compute the bit-flip string 
for the remaining N — q pairs, i.e., he knows all positions where the pair bears 
a bit-flip error. Bob flips those of his qubits from bit-flipped pairs in Z basis. 
The bit-flip error correction is completed here. 
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Fig. 16. They first do biCNOT operations in Z basis and then measure the target 
pair (pair 5) in order to obtain the parity value for the bit-flip string of a subset E 
which contains pair {1,4,5}. 

However, the phase-flip string for the remaining N — q pairs is not deter- 
mined yet. In doing the hashing for bit-flip string, the phase-flip string for the 
remaining pairs changes. However, the number of likely phase-flip string for 
the remaining pairs cannot be larger than u p , the number of likely phase-flip 
string for the initial N raw pairs. Because the initial phase-flip string of ./V 
pairs determines the phase-flip string of the remaining pairs after bit-flip hash- 
ing. Eq. (205) shows that given the initial phase-flip string, the later phase- flip 
string for the remaining pairs is determined exactly. Keeping this fact in the 
mind, they can then correct phase-flip errors: 

(2) Phase- flip error correction. They can also do hashing in X basis. Eq.(205) 
shows that the biCNOT operation can collect the parity value xaiqbi © 
XA2®B2 = phi © ph,2 into pair 1, i.e., the control pair. Therefore, given any 
set E, they can randomly choose pair d as the control pair and all the other 
pairs in set E as the target pair. They perform biCNOT gates between pair 
d the other pairs in set E. The parity value of J2ie.E x ai®bi before biCNOT 
operation can be obtained by measuring pair d in Xa&b basis after the biC- 
NOT operations. With this they can do hashing to correct phase-flip errors. 
Explicitly, at any step j > q, Alice announces Ej which is a random subset 
of all remaining pairs and pair dj G Ej. They do biCNOT operations in Z 
basis to collect the parity value J2ieEj ( x ai ® xbi) at pair dj. Pair dj, the only 
control pair is discarded after it is measured in Xa®b basis. They repeat this 
for p = NH(t p h) times and Bob can compute the phase-flip string for the 
remaining N — p — q pairs, i.e., he knows all positions where the pair bears 
a phase-flip error. Bob correct those phase-flipped pairs by a taking a phase 
shift operation to his own qubits. The purification is ended here. 
Remark: Similar to the phase-flip hashing also needs the biCNOT gates in Z 
basis. But the target pair and control pair are reversed. 



4-1-4 Reduction 

The above virtual entanglement purification protocol contains the following 
elementary operations: 
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• Bell measurement to each raw pair in the beginning 

• biCNOT gates 

• measurement in Za®b basis and measurement in Xa®b basis. 

The nonlocal measurements here are impossible tasks for Alice and Bob who 
are spatially separated. The CNOT operations are difficult tasks. We can get 
rid of all these in the real protocol by reduction. 

Since the Bell measurement commutes with biCNOT gates and any measure- 
ments in Za§b basis and measurement in Xa®b basis, we can delay the initial 
Bell measurement until the end of the protocol and we shall obtain the same 
state p for the outcome K pairs. We denote this protocol as protocol VI. 
Suppose the fidelity F = (4> +K \p\4> +K ) = 1 — e for the outcome pairs and e is 
exponentially close to 0. Consider another protocol V2 which simply skips the 
Bell measurement and performs everything else the same as protocol VI. The 
outcome K— pair state in protocol V2 is p'. obviously, if the Bell measurement 
were performed to each outcome pair of protocol V2, the state of the outcome 
pair of protocol V2 must be the same with that of protocol VI. Therefore, 

P = E (R{bvffihy}\p'\K{byJ>hy})\^b v #hy})(K{b y ,phy}\ ( 20 6) 

{by,phy} 

and \H-{b y ,phy}) = \Xb u phi) ■ ■ • \Xb K , P h K ), and any b y or ph y can be or 1. Also, as 
defined earlier, any \xa y b y ) is one of the 4 Bell states depending on its subscript 
value. This leads to 

(4> +K \p'\^ K ) = (4> +K \p\^ K ) = l-e (207) 

which means, although the outcome state of protocol VI and V2 can be dif- 
ferent, the fidelity results of the two protocols are the same. Since Eve's in- 
formation upper bound is dependent on F only [13 7], protocol VI and V2 are 
the same secure. We shall only consider protocol V2. 

There are still some other non-local measurements of Za®b an d Xa&b i n 
the protocol. However, since all these are performed on the pairs which are 
discarded in the protocol, it makes no difference if they take any further opera- 
tions to the discarded pairs. In the step of bit-flip correction, they can measure 
the discarded pairs in Z basis at each side and obtain YjIze z ai and J2i&e z bi 
separately and then calculate the parity value by formula 

E c * = E^ + E^- ( 208 ) 

i£E leE leE 

The individual measurement in Z basis at each side commutes with the non- 
local measurement Za®b therefore they can exchange the order of the two 
measurements. Furthermore, since the individual measurements in Z basis 
determines the outcome of the collective measurement Za^b, the collective 
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measurement is unnecessary. This is to say, in the protocol V2, all those nonlo- 
cal measurements Zz®b can be simply replaced by the individual measurement 
in Z basis at each side. 

The bit-flip error correction is now reduced to the following: At any step i, 
Alice announces Ei which is a random subset of all remaining pairs and pair 
di G Ei. They do biCNOT operations in Z basis to collect the parity value 
J2i£Ei ( z ai © zbi) at pair dj. They measure the target pair in Z basis at each 
side. Alice announces her measurement outcome, i.e., J2ieEi z ai- Bob calculates 
(SzeEi z ai) ffi {12i£Ei z bi) an d this is just the parity value of string Sb(Ei), the 
bit-flip string of pairs in subset Ei. They discard pair di. 

The phase-flip correction can also be simplified. Due to the same reason as 
stated above, after the biCNOT gates in a subset Ej is done, the non-local 
measurement Xa®b on the control pair can be replaced by measuring the 
control pair in X basis in each side because that pair will be discarded. Since 
their only purpose is to obtain a secure final key, they need not really correct 
the phase-flip errors. After Bob has known the positions of all phase-flips 
for the remaining pairs, he does not need to really correct the phase errors 
because this does not change the bit values of the final key and actually no 
one knows whether he has performed the correction. Therefore he even does 
not need to compute the positions of the phase errors provided that he can 
do so. Consequently, the measurement in Xaqb basis on the control pair is 
unnecessary and they can directly discard the pair without any measurement. 
This is to say, at each step of hashing for phase-flip string, they only need to 
do some biCNOT operations in Z basis and directly discard pair dj. Thus, all 
operations needed in both bit-flip correction and phase-flip correction can now 
be done in Z basis. Therefore, Alice can choose to measure all her halves of 
N pairs in Z basis before sending anything to Bob, i.e., she can directly send 
Bob N random qubits in Z basis and Bob can measure each of them before 
key distillation. The final key distillation becomes the distillation of the data 
from the measurement outcome in Z basis at Bob's side. 

We shall simply use error correction for the term bit-flip error correction be- 
cause the phase-flip error correction is now reduced to the Privacy ampli- 
fication: At any step j > q, Alice's bits and Bob's bits are identical. Alice 
announces a random subset Ej and bit dj G Ej. For any I G Ej, they replace 
Z\ by z\ © Zd 3 and they discard bit dj. Here zi is the bit value of the Ith bit in 
Ej. They need to repeat so by p steps and obtain the final key. 

If they don't use a quantum memory, Bob must measure each qubit once he 
receives it. In such a case Bob has no way to know the right basis of each 
individual qubit. Bob can randomly choose basis Z or X. They must discard 
those outcome from a wrong basis (basis mismatch). We have the following 
prepare-and-measure protocol: 
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(0) Alice and Bob have agreed that states |0), |0) represent for bit value and 
states |1), |1) represent for bit value 1. (1) Alice prepares 2(N + m) qubits. 
The preparation basis of each qubit is random, with a prior probability of 
P z = o^~!~"\ for Z basis, and P x = t^th — r for X basis. The bit value of each 

z 2(N+m) ' x 2(N+m) 

individual qubit is randomly chose from and 1. (2) Alice sends these qubits to 
Bob and Bob measures each of them in a basis randomly chosen from {X, Z}. 
Bob announces his measurement basis for each qubits and they discard those 
outcome from a measurement basis that is different from Alice's preparation 
basis. Approximately, there should be N + m classical bits remaining among 
which about m/2 are X bits (outcome of measurement in X basis) and iV + 
m/2 are Z bits (outcome of measurement in Z basis). (3) Bob announces the 
bit values of all X bits and the same number of Z bits for error test. They 
discard all the announced bits and there are about N bits remaining. After 
this error test, they know that the bit-flip rate and phase-flip rate for the 
remaining N bits are bounded by t b , t p h respectively. (4) They do bit-flip error 
correction and privacy amplification to the remaining N classical data as we 
have stated previously and obtain the final key. The final key rate is 

f = l-H(t b )-H(t ph ). (209) 

In the case t& = t p h = t, the noise threshold for BB84 protocol is 11% where 
its key rate hits 0. However, if we use the encoded BB84 states and/or if 
the key distillation is done with two-way classical communication, the noise 
threshold can be raised significantly, see e.g., Ref. [148,149,150,151]. Moreover, 
if the channel noise is asymmetric, one can also raise the efficiency [152]. 

Remark Besides the approach of entanglement purification, Koashi has pre- 
sented another simple and clear picture based on the uncertain principle [153]. 



4-2 Secure key distillation with a known fraction of tagged bits 

Although many QKD protocols such as the BB84[3] have been proven to be 
unconditionally secure[135, 137,138], this does not guarantee the security of 
QKD in practice, due to various types of imperfections in real-life set-ups. 
In practical QKD, the source is often imperfect. Say, it may produce multi- 
photon pulses with a small probability. Normally, weak coherent states are 
used in practice. The probability of multi-photon pulses is around 10% among 
all non-vacuum pulses. Here we shall show how to generate the secure final key 
even though the source is imperfect, i.e., with a small probability of sending 
multi-photon pulses. 
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4-2.1 Final key distillation with a fraction of tagged bits. 



For simplicity, let us imagine the following virtual case: Alice now sends Bob 
the BB84 states (with most of them being prepared in Z basis) from a perfect 
single-photon source. But, before sending out any states, she randomly chooses 
a small fraction of the qubits and tells Eve the right bases (and bit values) 
of them. This small fraction of qubits are called tagged qubits. It was shown 
by ILM-GLLP[154] that we can also distill the secure final key by a CSS 
code even with an imperfect source, if we know the bit-flip rate, phase-flip 
rate and upper bound value of the fraction of tagged bits, A. Here we give 
a simple proof. Suppose after Bob has measured each qubits he received and 
they discarded those outcome with basis mismatch, there are N + m classical 
bits remaining. About m of them will be used for error test, among which a 
half are Z bits and a half are X bits. The remaining N bits are all Z bits and 
they will be used for the final key distillation. We shall call them as untested 
bits. At this stage, any bit that is caused by a tagged qubit is a tagged bit. 
We assume Alice and Bob carry out the protocol as if they didn't know which 
ones are tagged qubits but they know the fraction of tagged bits, A. They now 
distill the final key with those N untested bits. They need to know the number 
of likely bit-flip string and the number of likely phase-flip string for those N 
untested bits. The error correction part is of no difference from that of the 
ideal protocol where there is no tagged bits, i.e., after they do the error test, 
they know that the upper bound of the bit-flip rate of those N untested bits 
is U- We shall use notations t^tag, h,untag for the upper bounds of bit-flip rates 
of the tagged bits and untagged bits from those N untested bits, respectively. 
We have 

Atbjag + (1 — &)tb,untag = U (210) 

Here i& is the averaged bit-flip rate of all those untested bits. The value of tb 
satisfies 

t b <t z + 5 1 (211) 

and t z is the observed bit-flip rate of those test bits in Z basis, 8\ is a small- 
value parameter due to the statistical fluctuation. The number of likely bit-flip 
string is bounded by 



2ANH(t bitag ) . 2( 1 - A ) NH ( t b,u n tag) < 2 NH ( t b). (212) 



Since they don't know the refined error rates for tagged bits and untagged 
bits separately, they can only use the value 2 NH ^ as the number of likely 
bit-flip string for error correction. What is a bit tricky is the number of the 
likely phase-flip string. Also, there are two groups of bits of the N untested 
bits, tagged bits and untagged bits. If the number of phase-flip string for the 
tagged bits is bounded by 0J P h,tag an d the number of phase-flip string for those 
untagged bits is bounded u) p h, U ntag then the number of phase-flip string for all 
N bits is bounded by 

^ph ^ph.untag ' ^ph,tag- 

(213) 
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Give any binary string of length y, in whatever case the number of likely string 
is bounded by 2 y . Therefore we have 

U ph ,tag < 2 AN . (214) 

To bound the value of uj ph:Untag , we must bound the phase-flip rate of those 
untagged untested bits. Asymptotically, this value is given by the error rate 
of those untagged test bits in X basis. The observed value t x is the averaged 
error rate of all those X bits (all the X bits are used for test) among which 
only a fraction (1 — A) are untagged bits. Therefore, the separate error rate 
for the untagged X bits could actually be larger than the averaged one, t x 
but it must be bounded by t x /(l — A) which corresponds to the worst case 
that all errors in X— basis are carried by those untagged X bits. Therefore the 
phase-flip rate of those untagged untested bits are bounded by 

t ph <j^ + S 2 . (215) 

Here 62 is a small-value parameter due to the statistical fluctuation. Therefore 
the number of likely phase-flip string of all those untested bits is bounded by 

u; ph <2 AN -2^ NH ^ +52 K (216) 

If N(l — A) is very large, 8\, 62 are a very small. Asymptotically, the final key 
rate is 

/ = 1 - H(t z ) - A - (1 - A)£T( r ^-) (217) 
which confirms the result of ILM-GLLP[154]. 

Remark: The bit-flip and phase-flip for a tagged bit is rather different. Consider 
the case with real entanglement. Once Alice tells Eve in advance the bit value 
in Z basis of certain pair, Alice must have already measured it in Z basis. The 
phase-flip is immediately very large even Eve does not touch it in the future. 
However, the bit-flip can still be given a noiseless channel. 

The above model applies to the important situation that Alice uses the source 
of weak coherent light, i.e., the weak light directly from a laser device. Say, the 
source may sometimes produce the multi-photon pulses. Obviously, to Alice 
and Bob, the situation here cannot be worse than the situation of tagged-bit 
model where Alice announces some of the basis (and bit values) therefore it 
must be secure here if they use the model of tagged bits to treat the imperfect 
source, provided that they know the value A for the raw bits. In the case of 
using the coherent light as the source, if a bit is created at Bob's side due to 
a multi-photon pulse from Alice, that bit is regarded as a tagged bit. If the 
channel is lossy, it is not a trivial task to know the tight upper bound of the 
fraction of tagged bits, A. Since we need to assume the channel to be Eve's 
channel for security, the channel transmittance can be very different for those 
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single-photon pulses (untagged qubits) and those multi-photon pulses (tagged 
qubits). Therefore the fraction of multi-photon pulses of the source can be 
very different from the fraction of tagged bits in Bob's raw key. In particular, 
if the channel is quite lossy, since Alice doesn't know which pulses are single- 
photon pulses, it is possible that the channel transmittance for single-photon 
pulses is and all bits in Bob's raw key are tagged bits. This means, without 
a good method to upper bound A tightly, the maximum secure distance for 
QKD with weak coherent light of intensity not less than 0.1 is about only 20 
kilometers given the existing detection technology [154]. 



4.2.2 PNS attack 

In practice, the channel can be very lossy. For example, if we want to do QKD 
over a distance longer than 100 km using an optical fiber and the light pulses 
of wavelength 1.55 fim , the overall transmittance can be in the magnitude 
order of 10~ 3 or even 10~ 4 . (Suppose the detection efficiency is around 10%.) 
This opens a door for the Eve by the so called photon-number-splitting (PNS) 
attack[127,128] as shown in figure (17). Suppose at a certain time Alice sends 
out a multi-photon pulse. Every photon inside the same pulse is in the same 
state in coding space, e.g., the polarization space. Eve can keep one photon 
from the pulse and sends other photons of the pulse to Bob through a trans- 
parent channel. This action will not cause any noise in the coding space but 
Eve may have full information about Bob's bit: After the measurement basis 
is announced by Alice or Bob, Eve will be always able to measure the pho- 
ton she has kept in the correct basis. Therefore, here we regard all those bits 
caused by multi-photon pulses from Alice as the tagged bits. According to the 
model given by ILM-GLLP[154] as we have studied, if the fraction of tagged 
bits in Bob's raw key is not too large, we can still obtain a secure final key by 
equation (217). In using this result, we must first know the value A. Alice does 
not know which pulse contains more than one photons, she only knows a dis- 
tribution over different photon numbers for all pulses. As we have mentioned, 
the fraction of multi-photon pulses from the source can be very different from 
the fraction of tagged bits in Bob's raw key, for, Eve's channel transmittance 
can be dependent on the photon number of the pulse from Alice. Naively, 
one can assume the worst case to estimate A: the channel transmittance for 
multi-photon pulses is 1 and we check how many raw bits are generated. If the 
number is larger than the number of multi-photon pulses, there must be some 
untagged bits. However, in such a way, the light intensity must be rather weak 
in order to have some untagged bits. Suppose the channel transmittance is rj 
and the light pulse intensity is x. The density operator of a phased randomized 
coherent state of intensity x is 

A^^E^-HH- ( 218 ) 
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Fig. 17. Schematic diagram for photon-number-splitting attack. Eve is in the middle 
and controls the channel. If Alice sends a single-photon pulse (untagged qubit), Eve 
may absorb it. If Alice sends a multi-photon pulse, Eve may split it and keeps one 
photon. Of courses, Eve has many other choices. 

Consider the normal case that there is no Eve, the channel transmittance is rj 
to every photon. If Alice sends N pulses, Bob will find N (l — e~ vx ) counts at 
his side. However, for security, they have to assume this to be Eve's channel. 
Using the naive worst-case estimation, we require 

1 - e- vx > e"V/2, (219) 

i.e., 

xe~ x < 2-q. (220) 

This shows, to guarantee that not all raw bits are tagged bits, the efficiency 
must be bounded by rf. Given that x > 0.1, we request r] > 4.5% to obtain 
non-zero secure key. For security, we have to assume that Eve can also control 
the instantaneous detection efficiency of Bob's detector. Thus, if Bob's detec- 
tion efficiency is 10% and the the light intensity loses a half over every 15 km, 
the cut off distance is not larger than 20 km. To obtain the secure final key 
with a meaningful key rate, we must have a better way to verify A, upper 
bound of fraction of tagged bits in raw key. 

Remark. Bob cannot verify the tagged bits at his side by measuring the photon 
number in each coming pulses. Suppose he finds certain pulse contains only 
one photon. The bit caused by that pulse could be still a tagged bit because 
the pulse could have contained two photons when Alice sent it. It is the photon 
number in the pulse at Alice's side that only matters for the security here. 

Earlier, the PNS attack has been investigated where Alice and Bob monitor 
only how many non-vacuum signals arise, and how many errors happen. How- 
ever, it was then shown[155] that the simple-minded method does not guar- 
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antee the final security. It is shown [155] that in a typical parameter regime 
nothing changes if one starts to monitor the photon number statistics as Eve 
can adapt her strategy to reshape the photon number distribution such that 
it becomes Poisonian again. Finding a faithful and tight upper bound for A 
value is strongly non-trivial because Eve can produce whatever type photon- 
number-dependent lossy channel that does not violate laws of the nature. Al- 
though some types of specific PNS attack, e.g., the beamsplitter attack could 
be detected by simple method such as tomography at Bob's side, a method to 
manage whatever lossy channel is strongly non-trivial. 

In short, given ILM-GLLP[154] result, the remaining task is to verify the 
fraction of tagged bits in Bob's raw key faithfully. A reliable tight verification 
is non-trivial. The central task for the decoy-state method is to make a tight 
verification of A, the upper bound of the fraction of tagged bits or equivalently, 
Ai, the lower bound of the fraction of untagged bits in Bob's raw key. 

Remark: In the above, in showing that certain old protocol is insecure, we have 
used some specific attacking schemes. Of course Eve can have many choices in 
the attack, e.g. methods in Ref[155]. Definitely, in showing that certain proto- 
col is secure, one should not assume any specific attacking scheme. We are now 
going to present the decoy-state method which does not assume any specific 
attacking scheme. The security of this method is only based on principles of 
quantum mechanics and classical statistics therefore is unconditional. 

4-3 Decoy-state method 

The first idea of decoy-state method and the first protocol is given by Hwang[140] 
Hwang proposed to do the non-trivial verification by changing the intensity 
of pulses. In Hwang's first protocol, two intensities are used. The intensity of 
signal pulses is set to be around 0.3 and the intensity of decoy-state pulses is 
set to be 1. By watching the counting rate of decoy pulses, one can deduce 
the upper bound of the fraction of tagged bits among all those bits caused by 
signal pulses. For the conceptual clarity and the mathematical simplicity, here 
we give up Hwang's original statement and derivation and we shall directly 
use the technique of density matrix convex[141] where only a few parameters 
are involved[141]. 

4-3.1 Basic idea and protocol 

We start from the classical statistics. 

Proposition 1. Given a large number of identical and independent pulses, the 
averaged value per pulse of any physical quantity for some randomly sampled 
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pulses must be (almost) equal to that of the remaining pulses, if both the num- 
ber of sampled pulses and the number of the remaining pulses are sufficiently 
large. 



In a standard QKD protocol with a perfect single-photon source, this propo- 
sition is used for the error test: They check the error rate of a random subset, 
and use this as the error rate of the remaining bits. Also, this proposition can 
be used for estimation of the averaged value of any other physical quantities, 
such as the counting rate. In the protocol, Alice sends pulses to Bob. Given 
a lossy channel, after a pulse is sent out from Alice, Bob's detector may click 
or not click during a certain time window. If his detector clicks, a raw bit is 
generated. Counting rate is the ratio of the number of Bob's clicks and the 
number of pulses sent out from Alice. More specifically, if source x sends out 
N x pulses and Bob's detector clicks n x times in the appropriate time windows, 
the counting rate for pulses from source x is 



Obviously, this quantity for any real source can be directly observed in the 
protocol itself. In the QKD protocol, Alice controls the source. We shall use 
the concept of a mixed source. Source X and source Y together make a mixed 
source if the following conditions are satisfied: (1) Each individual pulse has 
a probability px to be produced from source X and probability py to be 
produced from Y. (And px +Py = 1-) (2) The state of each individual pulses 
are independent. (3) Except for the states in the photon- number space, pulses 
from source X and pulses from source Y are indistinguishable by any other 
physical quantities, e.g., the wavelength, the polarization, the transmission 
path and so on. In particular, if X and Y make a mixed source and states 
of pulses from each source are identical in photon-number space, then the 
counting rate of source X must be equal to that of source Y, since in such a 
cases all pulses are identical and pulses from X can be regarded as the sampled 
pulses and pulses from Y can be regarded as the remaining pulses in using 
proposition 1. 

Proposition 2. Given that the light pulses from a mixed source that contains 
source X and source Y, if X and Y produce the same states in photon- number 
space, the counting rate for pulses from source X must be equal to that of 
source Y, provided that the number of pulses from each source is sufficiently 
large. 

One intensity we shall use in the protocol is /i. Imagine that all pulses of 
this intensity is produced by source A^. The state can be re- written in the 
following equivalent convex form: 




(221) 



p M = e-^|0)(0|+/ie^|l)(l|+ C p c 



(222) 
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and c = 1 — e M — /xe ^ > 0, 




(223) 



and Pfj,(n) = - — 7 — . This convex form shows that the source sends out 3 types 
of pulses: sometimes sends out vacuum, sometimes sends out |1)(1|, sometimes 
sends out pulses of state p c . Therefore, source can be equivalently regarded 
as 3 sources, A^o producing those vacuum pulses, A^i producing those single- 
photon pulses and A^ c producing those pulses in state p c . Nobody outside 
Alice's lab can tell whether Alice has actually used these 3 sources or A^, the 
real source. Those of Bob's bits due to the counts caused by the pulses in 
state p c from Alice are regarded as tagged bits. Since we know explicitly the 
probability of pulses p c for the source, we shall know the fraction of tagged 
bits if we know s c , the counting rate of state p c . The counting rate of any 
state p is the probability that Bob's detector counts whenever Alice sends out 
a pulse in state p. Suppose that Alice has another source, A' which always 
produces state p c and Alice sometimes uses A^ sometimes uses A'. This is to 
say, Alice uses a mixed source that contains A^ and A'. Since A^ itself can 
be regarded as three sources, we can also say that Alice has used source A^o, 
A ni and a mixed source that contains A^c and A'. Since the state of pulses 
from A^c is identical to that of A' in photon-number space, according to our 
proposition 2, pulses from source A^c and pulses from source A' must have 
the same counting rate. This is to say, by watching the counting rate of pulses 
from source A', Alice can judge the counting rate of all those multi-photon 
pulses from source A^. We can have the following artificial protocol: Alice 
sends many pulses to Bob with two sources, A^, A'. Among all these pulses, 
he knows which N' pulses are produced by source A'. After Alice sends out all 
pulses, Bob announces which time his detector has counted and which time 
has not. Alice finds that among all those counts at Bob's side, n' of them are 
due to those pulses from source A'. Then Alice knows the counting rate of 
source A' is n'/N'. This is also the counting rate of source A^, which is just 
the counting rate of all those multi-photon pulses from source A^. Note that 
Eve cannot treat the pulses from source A' and the pulses from source A^c 
differently. 

In the above artificial model, we have used source A' that only produces state 
p c . In practice we don't have such a source. But we can have another coherent 
light source, A^ which produces a coherent state with averaged photon number 
(intensity) pi (jj > p,p'e~^ > pe~^). We now consider the case that Alice 
uses a real mixed source that contains source A^ which produces the coherent 
state with averaged photon number (intensity) p and source A^. Alice can use 
only one laser device to produce such a mixed source by randomly switching 
the intensity between p, p! . Since p! > p and p'e~^ > pe~^, the state for 
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source A u > can be written in the convex form: 



fa = e~< l '\0)(0\+fi'e-> 1 '\l)(l\ + c^—-p c + dp d . (224) 

p z e v 

Here d > and pd is a density operator. We don't need the explicit formula for 
Pd-, we shall only need the fact that state p^i can be written in the above convex 
form. Source can be equivalently regarded as 4 virtual sources: A^iq which 
contains all vacuum pulses from A^, A^i which contains all single-photon 
pulses from A^, A^i c which contains all p c pulses of source A^ and A^ d 
that contains all pd pulses of source A^ . Also, source A^ can be equivalently 
regarded as 3 sources as we have mentioned before. Of course, A^c and source 
A^c make a mixed source and they produce identical states in photon number 
space. This means, by proposition 2, s c (p), the counting rate of state p c from 
source A^ is equal to s c (p'), the counting rate of state p c from source A^, i.e., 

s c (/-0 = s c (p) = s c . (225) 

By the same reason we have a more general formula for counting rate 

s a (p) = s a (p!) = s a . (226) 

Here the subscript a represents for a state. We shall use a — 0,1, c for (the 
counting rates of) vacuum state, single-photon state and state p c respectively. 
Remark: Source A^ and A^ are not identical and Eve can treat pulses from 
these two sources differently. But source A^ a and A^ a are identical and Eve 
cannot treat pulses from these two sources differently. 

Here Alice has only used two real sources, A^, A^. Counting rate of any real 
source can be observed directly in the protocol. But counting rate of a virtual 
source e.g., A^ c cannot be observed directly. We must deduce it mathematically 
based on the observed results of the protocol. 

Alice has no way to know which pulses are from source A^ a or source A m . 
But she knows which pulses are from source A^ and which ones from A^. We 
shall show that she can know an upper bound of the fraction of tagged bits 
from source A^ c by watching the counting rate of source A^. 

We denote the counting rates for source A^ and source A^ by S^, respec- 
tively. These values can be observed directly: 

S, = S, = (227 ) 

Np, N^i are number of pulses sent out from source A^, A^i respectively; n^, n^i 
are number of clicks of Bob's detector corresponding to pulses from A^, A^i 
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respectively. According to equation (224), we have the following equation: 



u /2 e _At ' 

= e'^'so + n'e^si + d s c + ds d . (228) 

p z e~' M 

Here we denote s , s x for the counting rates of vacuum pulses and single- 
photon pulses from A^, i.e. source A^q and A^\ , respectively, s c for counting 
rate of p c pulses from A^i, i.e., source A^ c and s d for counting rate of p d 
pulses from A^, i.e., source A^ d . Given the fact s > 0, s x > and > 0, 
we transform eq(228) into an inequality for the upper bound of s c : 

sc < -^w—rS,, (229) 

This is the bound value for counting rate of source A^/ c . This is also the 
bound value for pulses from any source that produces p c states only, including 
the source A^, i.e., those p c pulses from source A^. Therefore we have the 
following upper bound for the fraction of tagged bits for source A^. 

A < . (230) 

and we have used 

A = (231) 

In the normal case that there is no Eve's attack, Alice and Bob will find 
S^'/S^ = = p' / ^ in their protocol therefore they can verify A < , 

which is just eq.(13) of Hwang's work[140]. 

The above is the main result of Hwang's work. We have simplified the original 
derivation given by Hwang [140]. In short, Hwang's protocol works in this way: 
By watching the counting rate of decoy state (intensity //), we can obtain A 
value for the signal state (intensity p). 

Remark: Here a tricky point is that Eve cannot treat the pulses from A^ a 
and the pulses from A^ a (a = 0, l,c) differently although she can treat the 
pulses from A^ and the pulses from A^i somehow differently. Lets consider a 
similar classical story. There are professional basketball players and football 
players. We mix them and let them pass through a gate controlled by Eve. 
Eve knows that each one must be either a basketball player or a football 
player. Eve can partially distinguish each one's profession by his height: the 
taller ones are more likely to be basketball players. She can then produce a 
different transmission rate for the two types of players. For example, if she 
wants football players' transmission rate to be higher, she only needs to block 
all those taller guys. Consider a subgroup of football players Gf and subgroup 
of basketball players GV People in these subgroups are all in the same hight, 
1.80 m. Eve cannot treat people in these two subgroups differently according 
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to his profession. Say, given whatever strategy Eve may have used, if x% of 
guys in group Gf are blocked, there must be also x% guys in subgroup Gb 
being blocked. Here, all football players and all basketball players are in the 
same role of pulses from source and pulses from source in the decoy- 
state protocol. Players in subgroup Gb or subgroup Gf only are in the same 
role of pulses from source A^ or source A^i a in the decoy-state protocol. 

4-3.2 The issue of unconditional security 

The security of Hwang's method is a direct consequence of the separate prior 
art result of ILM-GLLP[154] therefore a separate security proof is not nec- 
essary. ILM-GLLP[154] have offered methods to distill the unconditionally 
secure final key from raw key if the upper bound of fraction of tagged bits 
is known, given whatever imperfect source and channel. Decoy-state method 
verifies such an upper bound for coherent-state source. We can consider an 
analogy using the model of pure water distillation: Our task is to distill pure 
water by heating from raw water that may contain certain poison constitute. 
Suppose it is known that the poison constitute will be evaporated by heating. 
We want to know how long the heating is needed to obtain the pure water 
for certain. If we blindly heat the raw water for too long, all raw water will 
be evaporated and we obtain nothing. If we heat the raw water for too short 
a period, the water could be still poisonous. "ILM-GLLP" finds an explicit 
formula for the heating time which is dependent on the upper bound of the 
fraction of poison constitute. They have proven that one can always obtain 
pure water if we use that formula for the heating time. However, the formula 
itself does not tell us how to examine the fraction of poison constitute. "Decoy- 
state" method is a method to verify a tight upper bound of the fraction of the 
poison constitute. It is guaranteed by the classical statistical principle that 
the verified upper bound by "decoy-state method" is (always) larger than the 
true value. Using this analog, the next question is how to obtain a tighter 
upper bound: if the verified value over estimates too much, it is secure but it 
is inefficient. 

Hwang's result is a large step towards the efficient and secure QKD with exist- 
ing setup. However, the result can be further improved for efficient application 
in practice. The estimated A value here is still too large. Given such a value, 
one cannot obtain a meaningful key rate in practice for long distance QKD 
with existing setups. We want a faithful and tighter estimation. We want a 
way to obtain a value that is only a bit larger than the true value in the nor- 
mal case that there is no Eve (for efficiency) , and it is always larger than the 
true value in whatever case (for security). The improved result of a tightened 
estimation of A including both the analytical formula in the asymptotical case 
and the numerical calculation in the non-asymptotic case are then given by 
Wang[141] and later confirmed and further studied by others[156]. 
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4-3.3 Improved decoy-state method 



The improvement is possible because Hwang's method has not sufficiently 
used the information of counts from different intensities. Actually, in doing 
the verification, Alice has only used the counting rate of one intensity, the 
source A^>. It should be interesting to consider the case that Alice uses more 
intensities and considers the observed results jointly. 

The decoy-state method is not immediately useful in practice until the more 
tightened estimation is given[141]. There[141], the counting rates of different 
intensities are treated jointly with non-trivial inequalities through the density 
operator convex technique. Quantitative results including both explicit for- 
mulas and numerical results are also given [141]. There [141], for the first time 
an explicit formula for the tight upper bound of A is given and the statistical 
fluctuation is studied with detailed numerical results are presented. Earlier, 
a review on Hwang's result with some rough ideas were presented [157]. How- 
ever, there is no quantitative result though it proposed to use vacuum to test 
dark count and very weak coherent state to test single-photon counting rate. 
Naturally, one can expect a higher key rate if one uses more intensities. The 
key rate in the limit of using infinite intensities is studied in [142]. 

Here we are most interested in a protocol that is practically efficient. Obviously, 
there are several criteria for a practically efficient protocol. 1. The protocol 
must be clearly stated. For example, there should be quantitative description 
about the intensities used and quantitative result about the verification. Be- 
cause we need the explicit information of intensities in the implementation 
and the explicit value of A for key distillation. 2. The result of verified value 
A should be tight in the normal case when there is no Eve. This criterion is to 
guarantee a good final key rate. 3. It should only use a few different intensi- 
ties. In practice, it is impossible to switch the intensity among infinite number 
of different values. 4. It should be robust to possible statistical fluctuations. 
Note that the counting rates are very small parameters. The effects of possible 
statistical fluctuations can be very important because the repetition rate of 
any real system is limited hence we cannot assume too large the number of 
pulses. 

Concerning the above criteria, tightened estimation of A value is then obtained[141] 
through jointly using the information of counting rates of 3 intensities, vac- 
uum, /i and /i'. We call this protocol as 3-intensity protocol [141]. For conve- 
nience, we shall always assume 

p! > n\ n'e-* 1 ' > iuT* (232) 

in this paper. Since we randomly change the intensities among 3 values, we can 
regard it as a mixture of 3 sources. Source A that produces vacuum pulses, 
source that produces coherent-state pulses of intensity /i and source A^i 
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that produces coherent-state pulses of intensity fj/. States from source and 
A are given by Eq.(222) and Eq.(224), respectively. In the protocol, they can 
directly watch the counting rates of each source of A , A, Ayj as we have stated 
before, i.e., S^S^i are shall be regarded as known parameters. Suppose they 
find Sq, Sp, for each of them. In the asymptotic case, we have the following 
equations: 

S fl = e'^So + /ie-^si + cs c (233) 

S = e^'So + t/e-n's! + c^—-s c + ds d (234) 

In the above we have used the same notations So, Si, s c in both equations. This 
is because we have assumed that the counting rates of the same state from 
different sources are equal. So, S M , are known, si and Sd are unknown, but 
they are never less than 0. Therefore setting Sd, si to be zero we can obtain 
the following crude result by using Eq.(234) alone. 

cs c < (S> - e^'So - fjfe-^'si) . (235) 

Since s\ > 0, we obtain a crude result for the upper bound of s c 

cs c < J^£L (S, - e-*S ) . (236) 

However, we can further tighten the verification by using Eq.(233). Having 
obtained the crude result above, we now show that the verification can be 
done more sophisticatedly and one can further tighten the bound significantly. 
In obtaining inequality (236), we have dropped terms s\ and Sd, since we 
only have trivial knowledge about Si and Sd there, i.e., s\ > and Sd > 
then. Therefore, inequality(236) has no advantage to Hwang's result at that 
moment. However, after we have obtained the crude upper bound of s c , we can 
have a larger-than-0 lower bound for si by Eq.(233), provided that our crude 
upper bound for s c given by Eq.(236) is not too large. Combining the crude 
upper bound for s c given by Eq.(236) and Eq.(233), we have the non-trivial 
lower bound for s\ now: 

si > S M - e-^So - cs c > 0. (237) 

With this new lower-bound of S\, we can further tighten the upper-bound of 
s c by Eq.(235) and obtain a more tightened s c . With the new s c , we can again 
raise the lower bound of S\ by Eq.(233). The final bound values are determined 
by infinite iterations. Therefore tight values for s c and Si can be obtained by 
solving the simultaneous constraints of equation (233) and inequality (235). 
We obtain 

a'S — a c S' a\S — aiS' 
si > —, s c < -7 — (238) 

Qi\(l c — CL^CL C CL-^CL C — (X\(l c 
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and S — Sp — e ^Sq, S' = — e ^ So, a± = fie ^, a[ = fi'e M ', a c = c, a' c 



Given these, we can easily find the lower bounds and upper bounds 
for the fraction of untagged bits and tagged bits for both intensity /i and fi'. 
In general, raw bits caused by both intensities can be used for the final key 
distillation. For the intensity /i, we have 

ue~^Si cs c , 

Ai = A = (239) 

for the fraction of untagged bits and tagged bits, respectively; for the intensity 
fjf, we have 

Ai = A' = ^ (240) 

for the fraction of untagged bits and tagged bits, respectively. For example, 

A<^(^-l)+^. (241) 
fi' - fi \fi'e ^ Sf, J n'Sp 

Also, through the fact of 

A + Ai + A = 1 (242) 

we have 

Ai = 1 — A - e-"a /^ (243) 
and Ao is the fraction of vacuum counts. In the case of so << rj, if there is no 
Eve, SU Sfj, = fi'/ fi. Alice and Bob must be able to verify 



fi, I " M 



fi' — fi 



= fi (244) 

H'-H-tO 



in the protocol. Of course, other parameters such as A' x , A' can also be calcu- 
lated explicitly by Eq. (238,240). Given these, we can distill the final key from 
both intensities. The values of fi, fi' should be chosen in a reasonable range, 
e.g., from 0.2 to 0.6. Actually, we can distill more final bits from raw bits 
created by intensity fi' than that of fi, we shall call pulses of intensity fi' as 
the signal pulses and pulses of intensity fi as decoy pulse for simplicity. 

Summary: The 3-intensity decoy-state protocol is stated by the following: Alice 
switches the intensity of each pulses randomly among 3 values, 0, fi ~ 0.2 
and fi' ~ 0.5. Suppose she sends out N pulses of intensity 0, iV M pulses of 
intensity fi and pulses of intensity fi'. Bob then announces which pulses 
have caused a click. According to Bob's announcement, Alice knows that the 
pulses of intensities 0, fi and fi! have caused riQ,n^,n^i clicks at Bob's side. 
Alice uses So = f^, S^ = jf- and S^i = jf^ as the input of eq.(241) and obtain 

the value A. She can also obtain the value of other parameters such as A', A 1; 
and A' x based on this. Raw bits caused by both intensities of fi and fi' can be 
used for the final key distillation, if the key rate is larger than 0. 
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4-3.4 Statistical fluctuations 



The results above are only for the asymptotic case. Before applying the decoy- 
state method in practice, we must first resolve the very important security 
problem related to the statistical fluctuation. In practice, the number of pulses 
are finite thus there are statistical fluctuations, i.e., Eve has non-negligibly 
small probability to treat the pulses from different sources a little bit differ- 
ently, even though the pulses are in the same state. This problem was first 
proposed and solved in [141] and then further studied[156,158]. Mathemati- 
cally, this can be stated by 



and the real number r a is the relative statistical fluctuation for s a , a = 0, 1, c. 
It is insecure if we simply use the asymptotic result in practice. Since the 
actual values are actually different from what we have estimated from the 
observed data. Our task remaining is to verify a tight upper bound of A and 
the probability that the real value of A breaks the verified upper bound is 
exponentially close to 0. 

The counting rate of any state p from different sources now can be slightly 
different with a non-negligible probability. We shall use the primed notation 
for the counting rate of any state from source A p i and the original notation 
for the counting rate Of any state from source A. Explicitly, constraints of 
Eq(229,237) are now converted to 



for a = 0, 1, c. For security, we need to seek the worst-case solution of s[ or s' c 
of the above equations over all possible r a . As shown in ref[161], the maximum 
values of {r a } lead to the smallest solution of s[ or largest solution of s' c in the 
equations above. What is the reasonable largest value of r a ? We can figure 
out the issue by classical statistics. We regard r aM as the upper bound of r a 
if the probability that r a > r aM is exponentially close to 0. 

Given N1+N2 copies of state p, suppose the counting rate for N\ randomly cho- 
sen states is s p and the counting rate for the remaining states is s' p , the proba- 
bility that \s p — s' p \ > 5 P is less than exp (— O5 p 2 N /sp) and iVo = Min(Ai, A 2 ). 
Now we consider the difference of counting rates for the same state from differ- 
ent sores, A and A p i . To make a faithful estimation with exponential certainty, 



s a (p) = (1 +r a )s a (p') 



(245) 




(246) 



with setting 




(247) 
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we require S P 2 N /s p = 100. This causes a relative fluctuation 



T ^ 7/- 10 /5' (248) 

The probability of violation is less than e~°^ 100 \ To formulate the relative 
fluctuation r±,r c by s c and s±, we only need to check the number of pulses 
in states p c , |1)(1| in each sources in the protocol. That is, using eq.(248), 
we can replace ri,r c in eq.(246) by 10e M / 2 y^j-^, 10-y/^y, respectively and 
N is the number of pulses in source A. With these inputs, eq.(246) can now 
be solved numerically for the largest value of s c in the likely range of sta- 
tistical fluctuation, i.e., the fluctuation beyond the assumed range is in the 
magnitude order of e-°( 100 ). Good numerical results for a tighten estimation 
of A value have obtained [141] by many parameter settings based on existing 
technology[121,122]. For example, given /i = 0.3, // = 0.43, and r\ = 10~ 3 , we 
obtain A = 34.4% which is greatly less than Hwang's asymptotic result 60.4%, 
though it is still a bit larger than the true value, 25.9%. Definitely, we can 
also replace s a by s' a (l + r a ) (a = 0, 1, c) in Eq.(246) and then find out the 
worst-case result for s' c numerically. The fraction of multi-photon counts 
for pulses of intensity // have also been tightly verified [141]. 



4-3.5 Robustness with respect to small errors 

We now study how robust the method is. In the protocol, we use different 
intensities. In practice, there are both statistical fluctuations and small op- 
erational errors in switching the intensity. We shall show that, by using the 
counting rates of 3 intensities, one can still verify tight bounds even we take 
all theses errors and fluctuations into consideration. 

There are small operational errors inevitably. Say, in setting the intensity of 
any light pulse, the actual intensity can be slightly different from the one we 
have assumed. There are also fluctuation to the photon number distribution 
for each intensities[159]. 

At any time Alice decides to set the intensity of the pulse to be fi or //, the 
actual intensity could be /ij, which can be a bit different from p or fi'. 
The intensity errors of different pulses can be correlated. Due to this possible 
correlation, neither the decoy pulses nor the signal pulses are independent, the 
state of decoy pulses or signal pulses cannot be simply represented by a single- 
pulse density operator as described by Eq.(218). With the correlated intensity 
error, the pulses from class A m and class A^a (a = 0, l,c) are actually not 
randomly mixed in the protocol as shown below therefore the conditions for the 
propositions of decoy-state method are not satisfied. For example, the intensity 
can be dependent on the temperature. In a certain interval, all pulses can be 
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brighter or darker than the supposed value. Consider an extreme example. 
Suppose the actual intensity of each pulse is 10% larger than the supposed one 
in the first half of quantum-state transmission, 10% lower than the supposed 
one in the second half of the transmission. If Eve's channel transmittance is 
4t during the first half of pulse transmission and t during the second half of 
pulse transmission, s\, the counting rates of pulses from source A^i and s[, 
that of class A^i can be calculated by: At ^^^'kxofaf-o^ with the setting 
of x = /i, «' '. For fi = 0.2, u' = 0.6, we find s\ = 1.023^ rather than Si = s[. 
This has clearly shown that Proposition 2 cannot be blindly used because 
here because A^i and A^i are not randomly mixed, although they contain 
the same quantum states. The "randomly mixing" condition for two sources 
A m , A^ a requires the following condition: For any pulse sent out from Alice, 
if it belongs to A^a U A^> a , the probability that the pulse belongs to A^a and 
the probability that the pulse belongs to A^i a must be constant throughout 
the quantum communication stage of QKD. But the correlated intensity error 
can violate this requirement. 

The problems listed above can be overcome in various ways[160,161,162]. First, 
there is a theory[160] for whatever error pattern provided that the largest 
intensity error of a single pulse is not too large. But in such a case, the final 
key rate drops drastically with the intensity error. As is shown in Ref.[161], if 
the intensity errors are random and independent, even though there are large 
errors, such as 20% fluctuation, the key rate is almost the same with the ideal 
case where the intensity is controlled exactly. The efficiency becomes quite 
good here because the linear terms of the fluctuation disappear and only the 
quadratic terms of the fluctuation take effect in the protocol. To make sure 
that the intensity error of each pulse is random, we can use, for example, the 
feed forward control demonstrated under another topic [163]. If we are not sure 
of the error pattern, we can also use the method proposed in Ref.[162], where 
we request that at each time, a father pulse is produced and then attenuated by 
a two- value attenuator to create a decoy pulse or a signal pulse. This method 
works for whatever error pattern and also the key rate is quite good. Say, if 
the intensity error is bounded by 5%, to reach the same key rate of the ideal 
protocol, the distance given by the method of Ref. [162] is only 1 km shorter 
than that of the ideal protocol where pulse intensities are controlled exactly. 

Due to the small operational error, the intensity of light pulses in source Aq 
could be slightly larger than 0. This doesn't matter because a little bit over 
estimation of the vacuum count will only decrease the efficiency a little bit but 
not at all undermine the security[161]. (Eq.(241) shows that overestimation 
of dark counts will lead to overestimation of A value.) Therefore we don't 
care about the operational error of this part. Say, given no counts for all 
the pulses from source Aq, asymptotically, we can simply assume the tested 
vacuum counting rate to be so = n /N Q , though we know that the actual value 
of vacuum counting rate is less than this. 
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4-3.6 Final key rate and further studies 



Given the methods to verify A, the upper bound of fraction of tagged bits or 
Ai, the lower bound of fraction of untagged bits, we can calculate the final key 
rate by Eq.(217). However, there are more efficient formulas. As it is pointed 
out in Ref[142], actually, one need only correct the phase-flip errors of single- 
photon counts and remove tagged bits for privacy amplification. In particular, 
the following formula is recommended [142, 156] for key rate of any intensity x: 



Qi(x) = Ai(x) + A (x) - H{E{x)) - A 1 (x)i/(e 1 ). (249) 



Here Ai(x) and Ao(x) are fractions of single-photon counts and vacuum counts 
respectively for the intensity x which can be either \x or //; E(x) is the observed 
error rate of bits caused by source A x and t\ is the error-rate of counts caused 
by single-photon pulses. This formula gives a higher key rate than that of 
Eq.(217). Given A value or Ai(x) value, t\ can be estimated efficiently. We 
only need to derive the e\ value. We can do so by using the weaker source[156], 
intensity /i. Obviously, if the observed total error rate is E(f/) for source fj,, 
then e\ can be calculated by 



ei = t ; \ ■ (250) 



After the major works presented in[140,141,142], the decoy-state method has 
been further studied[158-171,277]. For example, Harrington et al. [159] numer- 
ically studied the effect of fluctuation of the state itself. Ref. [158] proposed a 
4-state protocol: using 3 of them to make optimized verification and using the 
other one fi s as the main signal pulses. This is because, if we want to optimize 
the verification of A value, /i, // cannot be chosen freely. Therefore we use 
another intensity fi s to optimize the final key rate. It is shown numerically 
on how to choose the intensity for the main signal pulses (fi s ) and good key 
rates are obtained in a number of specific conditions. The results of final key 
rates [141, 158] show that good key rate can be obtained even the channel trans- 
mittance is around 10~ 4 . There are even improved formulas for a higher key 
rate[164,165]. This corresponds to a distance of 120-150 kilometers for prac- 
tical QKD with coherent states. Using two-way classical communication [148] 
in the final key distillation can further increase the QKD distance [166]. The 
theory of decoy-state has now been extensively demonstrated by a number of 
experiments[167,168,169,170]. The decoy-state method also applies to other 
types of source, e.g., the parametric-down-conversion source[171]. 
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4-3.7 Summary 



Given the result of ILM-GLLP[154], one knows how to distill the secure final 
key if he knows the fraction of tagged bits. The purpose of decoy state method 
is to do a tight verification of the the fraction of tagged bits. The main idea 
of decoy-state method is to use different intensities of source light and one 
can verify the fraction of tagged bits of certain intensity by watching the the 
counting rates of pulses of different intensities[140]. With the mathematical 
technique of density operator convex and jointly treating the counting rates 
of different intensities with non-trivial inequalities[141], the upper bound of 
fraction of tagged bits or the lower bound of the fraction of untagged bits can 
be verified so tightly [141] that the decoy-state method is immediately imple- 
mentable with the existing matured technology. Since the counting rates are 
small quantities, and in any real setup, the number of different intensities and 
pulses are limited, the effect of statistical fluctuation is very important [141]. 
It has been shown that the decoy-state method can work in practice even with 
the fluctuations and other errors[141]. If one uses infinite number of different 
intensities and each intensity consists of infinite pulses, one can actually verify 
the A value perfectly [142]. The decoy-state method has promised a distance of 
120-150 kilometers for practical QKD[141,158]. To further raise the distance, 
we need to improve the existing technologies, this includes decreasing the dark 
counts, raising the detection efficiency and the system repetition rate. 

Remark: Although decoy-state method is promising for the practical quantum 
key distribution, it is not the only choice. Other promising methods for prac- 
tical QKD include the method using strong reference light [144], the mixed 
B92 protocol[143] (i.e., SARG04 protocol ), and so on. For those earlier pro- 
tocols and implementations, one may refer to the excellent review on QKD 
presented by Gisin, Ribordy, Tittle and Zbinden[13]. For a review of most 
recent developments of QKD theory, one may refer to Ref[172]. 



44 SARG04 protocol 



This protocol wa proposed by Sacrani, Aci, Rigbord and Gisin in 2004 [143], 
and is called SARG04 protocol. The protocol uses BB84 states but the bit 
value of each qubit is represented by its preparation basis, say, Z basis for 
and X basis for one. Consider the B92[144] protocol first. Alice may send 
Bob either state |0) in Z basis or state |+) in A basis. Bob will measure each 
qubit in either X basis or Z basis and he has a probability 1/4 to obtain a 
conclusive result. For example, suppose Alice has sent him a state |0). If Bob 
measures it in Z basis, he will be surely obtain |0) and they will discard this 
data, because both |0) and |+) can lead to this result and Bob does not know 
whether the bit value is or 1. However, if he measures it in X basis, he could 
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obtain a conclusive result. If he obtain |+), they will discard the data because 
Bob does not know the bit value. But if he obtain |— ) which is orthogonal 
to |+), Bob concludes that the qubit must have been prepared in state |0) 
by Alice. In summary, Bob changes his measurement bases between Z and X 
randomly and those measurement results of 1 1) and |— ) indicate conclusive 
bit values. They will only use those conclusive bit values. 

There is a security drawback of B92 protocol given a lossy channel, though it 
is unconditionally secure if the lossy rate is lower than certain threshold [173]. 
Obviously, if the channel transmittance is less than 1/4, it cannot be secure 
because Eve may measure each qubit in the middle in either Z or X, with 1/4 
probability, she obtains a conclusive result and she re-produces Alice's state 
and sends it to Bob through a transparent channel; with 3/4 probability the 
result is inconclusive, she blocks it and pretends her action to be channel loss. 

SARG04 has developed the B92 protocol and avoided the above drawback. 
SARG04 uses 4 states which are just the BB84 states. Bob will just measure 
each qubits in either Z basis or X basis. Then, Alice announces a set of two 
states for each qubits. There are 4 possible sets, S 0+ = {|0), |+)}, Sq~ = 
{|0), |-)}, S 1+ = {|1), |+)}, Si- = {|1), |-)}. Each BB84 qubit must belong 
to at least one set in the above. Alice just randomly chooses a set that contains 
the state of that qubit. After Alice's announcement of a specific set for each 
qubit, Bob knows which of his data corresponds to the conclusive results. 
Explicitly, whenever Bob obtains an outcome state that is orthogonal to one 
of the two states in Alice's announced set, he has obtained a conclusive bit. 
And they discard the other data. 

One obvious advantage of the SARG04 protocol is that it does not change the 
physical set-up of BB84 at all therefore can be immediately used in practice. 
And, not only has it overcome the drawback of B92 protocol itself, but also it 
is secure under the PNS attack even we use weak coherent light with a very 
lossy channel. For example, we consider the case that the pulse contains 2 
photons. In this case Eve can split the pulse and keep one photon. Suppose 
the actual state is |0) and later Alice announces a set S 0+ . Suppose Bob has 
happened to obtain a conclusive result. In such if Eve also measures 

it in a basis randomly chosen from X, Z, Eve only has a possibility of 1/4 
to obtain a conclusive result. In the normal realization of BB84 with one 
intensity of coherent light, Eve can obtain all information of Bob's raw key 
by the PNS attack. But the same attacking scheme may only allow Eve to 
be sure of 1/4 of Bob's raw key in the SARG04 protocol. Of course, Eve may 
have many other choices[174]. However, as it has been shown by Koashi[175], 
given whatever Eve may take, the SARG04 protocol with weak coherent light 
is always secure with a net final key rate at least in the magnitude order of 
0(rf/ 2 ). Moreover, if we increase the number of possible bases, the key rate 
can be further raised[175]. 
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4-5 QKD in position-momentum space 



In principle, BB84 protocol of quantum key distribution is secure because it 
uses 2 bases and measurements in these two bases do not commute. By the 
uncertainty principle, if Eve looks at the transmitted qubits in whatever ba- 
sis, she must cause noise to thoses qubits prepared in another basis. The key 
point here for security is the noncommunity of two bases. Therefore, secure 
QKD should not be limited to quantum states in two-level space such as po- 
larization and phase coding. It should also allow protocols with quadrature 
measurements of continuous variables, for example, the position and momen- 
tum. For simplicity, we shall call any quadrature observable as position x and 
momentum p provided that they satisfy the same commutation relation. 

Basically, Alice can encode the bit values in either position or momentum. If 
Eve looks at the bit values in position basis, she must cause noise to the infor- 
mation in momentum basis, and vice versa. There have been a number of pro- 
tocols for QKD in position-momentum space[176, 127,177,178, 179,180, 181, 182,183, 184,185,186]. 
All these protocols encode the bit values by Gaussian states, more specifically, 
coherent states or squeezed states. Most of the studies about the security are 
limited to the individual attack while the effects of collective attack is rarely 
discussed [187]. The only unconditional security proof uses one-mode or two- 
mode squeezed states based on the idea of purifying the encoded two-level 
entangled pairs[145]. Here we shall first review the protocols with coherent 
states and squeezed states, and then go into the unconditional security proof. 



4-5.1 Protocols of QKD with Gaussian states 
A. Protocols with coherent states. 

We can take two types of displacement on a coherent state, say, position dis- 
placement e~ tx P and momentum displacement e ipx . A possible protocol works 
as follows[177]. Alice generates two random numbers and modulates these 
numbers on a coherent state by taking displacement operations in position 
and momentum respectively. Bob detects either position or momentum of each 
light pulse. By a public channel, they compare their results of those times Bob 
has measured the momentum. If Bob's results agree with Alice's in an accept- 
able rate, they would use the position value as the raw key, i.e., the results 
of the times Bob has measured in position basis. Otherwise, they discard the 
protocol. 

Consider the most intuitive Eve's attacking. To each pulse, Eve could guess 
a basis that would be used by Bob and she measures in this basis herself 
and then reproduce a coherent state with the same displacement in that basis 
and sends it to Bob. However, in average, there is 50% probability Eve makes 
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wrong guess and Bob will find large noise at those times Eve has used a wrong 
basis therefore Eve's presence will be detected according to the protocol itself. 
This is similar to the case of original BB84 protocol. 

However, Eve may do it more sophisticatedly given a lossy channel. Suppose 
the channel transmittance is only 50%. But Eve may have a channel with per- 
fect transmittance. Eve may then split each pulse by a 50:50 beam-splitter. 
She keeps one daughter pulse and sends the other one to Bob through a perfect 
channel. Bob can not detect Eve's presence because Eve has just pretended her 
action to be the channel loss. After Bob announces the measurement basis for 
each pulse, Eve measure her pulses accordingly. In such a way, Eve's amount 
of information about Alice's key is the same with that of Bob. Therefore, 
a necessary condition for such a QKD protocol with coherent state is that 
the channel loss should be less than a half [181]. However, such a necessary 
condition is only for the case of key distillation with one-way classical commu- 
nication. In this case, Bob accepts all remaining bits if the protocol passes the 
error test. However, if they use two-way classical communication, they may 
discard those bits with larger error rate and only keep those bits with smaller 
error rate[182]. This is a kind of advantageous distillation by post-selection. If 
they use this post-selection, the channel loss does not have to be less than a 
half for a secure QKD. With the method of post-selection, Alice and Bob can 
do QKD even more efficiently [185]. Bob actually doesn't have to switch his 
measurement bases. Alice draws two random numbers xa,Pa and sends Bob 
a coherent state of |a) = \xa + Wa)- Bob splits it by a 50:50 beamsplitter and 
measures one daughter pulse in position basis and the other in momentum 
basis. They use post-selection[182] to reverse any initial "information advan- 
tage" a potential Eve may have obtained and distill a final key. This type 
of QKD without bases switching has been demonstrated experimentally with 
a channel loss up to 90% [185]. Actually, if Eve only uses individual attack 
by a beamsplitter, the secure distance for QKD with coherent states is un- 
limitted, if a sufficiently large post-selection threshold is set. Some experiments 
of QKD with position-momentum measurement have been done by using the 
homodyne detection[180,185,186]. 

Beyond the framework of BB84 and its variants, Yuen's group proposed a 
key expansion scheme [188] with mesoscopic coherent states by making use of 
the noise of the states (Y-00 protocol). The security issue of Y-00 has been 
actively discussed[189,190]. 

B. Protocols with squeezed states. 

There are also proposals for QKD with displaced squeezed states of one-mode 
or two-mode, e.g., [178]. If we use squeezed states, the source noise is com- 
pressed. A coherent state has the same statistical fluctuations in the two bases. 
But a squeezed state can have a smaller noise in one basis and largere noise 
in another basis. For example [178], Alice can send displaced squeezed vac- 
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uum state to Bob, which is squeezed in either position basis or momentum 
basis. Bob measures each pulse in a basis randomly chosen from position or 
momentum. Again, the security here is a result of uncertainty relationship. 

Consider the case of infinite squeezing. Alice may either produce a random 
position eigenstate or a random momentum eigenstate. In this case, if Bob 
measures a state in the right basis, he obtains a value that is identical to 
Alice's value. Also, a position eigenstate distributes uniformly in momentum 
space, and vice versa. This means, if the state is has been measured in a wrong 
basis, it would very likely produce a wrong result if it is measured latter by 
Bob in the right basis. Alice and Bob will only use those data obtained from 
the right bases. If Eve has intercepted the state and measured it in a basis as 
she guessed and then reproduced a state according to her measurement result 
and sent it to Bob, there is 50% probability that she has caused large noise. 

In practice, infinite squeezing is not available. However, finitely squeezed states 
also have the similar property. If it is squeezed in position basis and its aver- 
aged position (momentum) is x A , then with high probability the measurement 
result falls inside a small interval centered by x A , if one measures it in position 
basis. But, if anybody measures it in momentum basis, the result would be in 
a large range. This means that Eve will cause large noise to the state squeezed 
in position basis if she measures it in momentum (position) basis. In the QKD 
protocol with finite squeezing, Alice will only use a set of discrete values as the 
averaged position and momentum for squeezed states in each basis. The states 
in the same basis with different discrete values are almost orthogonal, but the 
overlap of states between different bases are considerable. Explicitly, consider 
the squeezed vacuum state S(r) |0) and operator S(r) = expfra^ — ra 2 ]. If we 
take a displacement operation D(xa,Pa), this state will be centered at xa,Pa 
in position space and momentum space respectively. If we measure the posi- 
tion, the probability that the result falls inside the interval (xa — 5/2, xa + S/2) 
is 

fXA+S/2 

Ps = (x\p(x A ,p A ,r)\x)dx (251) 

Jx A ~5/2 

and p(xa, Pa, r) is the density operator of displacement squeezed vacuum state, 
which is squeezed in position basis and centered at xa and pa respectively 
in position space and momentum space, respectively. After calculation one 
finds[178] 

Pi =erf(^) (252) 

and v = l/2e- 2r , 

erf(x) = -= / X e~ t2 dt. (253) 

y'KJQ 

If we choose 5 to be 1/8 and r = 3.3, the probability of obtaining a wrong 
value (a value that is outside the assumed interval of S centered at xa) is less 
than 10~ 3 . However, if the measurement is done in momentum basis, the likely 
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interval will be e r /2 which is more than 100 times larger than 5. This is to say, 
whenever Eve measures a pulse in a wrong basis, she must cause large noise 
to the state therefore her presence will be detected. If they use the coherent 
states, the interval S for the right basis will become larger and the interval in 
wrong basis will be smaller. 

However, in practice, the channel can be very lossy. As it has been calculated [177], 
the effects of channel loss is rather severe. Even Alice starts from the infinitely 
squeezed state, if we want the same error probability for the same interval as 
shown above, the transmission distance in the normal optical fiber can be only 
1 km, with a loss rate of 1.2 x 10~ 6 /m. Eve may attack the protocol more ef- 
fectively by pretending her action to be the channel loss. Again, here she can 
use beam-splitter attack. As it has been shown [178], the negative effect of loss 
can be reduced by amplifiers and the method is secure against the individual 
beam-splitting attack. 

There are also proposals of QKD with 2- mode squeezed light [177, 179]. Given 
2-mode squeezed states, it is possible to make a pre-determined key [179]. The 
protocol inspects eavesdropper by checking quantum correlation of two beams, 
one with Alice and the other sent with Bob. This is the analog of Ekert 91 
protocol [147] with Gaussian entanglement. 



4-6 Security proof of QKD with squeezed states 

So far we have not considered the issue of unconditional security. It has been 
shown by Gottesman and Preskill[145] that one can do unconditionally secure 
quantum key distribution with one-mode (or 2-mode) squeezed states. To 
make the proof, they first construct the encoded 2x2 EPR pair state [84] and 
then use the similar reduction technique as used in the case of qubit-QKD by 
Shor and Preskill[138]. (Definitely, one can also use the method in section 4.1 
for final key distillation.) As a result, QKD with one-mode squeezed state is 
unconditionally secure under whatever type of eavesdropping. 



4-6.1 Security proof of QKD in position-momentum space. 

As we have mentioned in section 2.5, we can use encoded 2x2 EPR state in 
position-momentum space 

l0 + ) = -^(|OO) + |ll)) (254) 

and 
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|0) oc \ x = 2s Vn) oc^2\p = s^/n); 

— oo — oo 

OO OO 

|1) oc ^ \x = {2s + 1)Vtt) oc ^(-l) s |p = sv 7 ^)- (255) 

— oo — oo 

Here we have bit-flip operator 

a x = (256) 

which causes a bit-flip of |0) — > |1); |1) — > |0); phase-flip operator 

a, = e*^ (257) 

which causes a phase-flip of |0) — > |0); |1) — > — If Alice starts with such 
states and then do entanglement purification as if they were two-level states, 
they can obtain the secure final key. More explicitly, Alice sends half of each 
pair to Bob. They will measure e t2y ^ x and ^- %2 ^v to determine the values of 
x or p modulo yfn and then add a displacement to the state to adjust it to 
the nearest integer multiples of \/tt. The noisy channel could have shifted a 
few states to an extent that it has a wrong nearest integer multiples of t/tt. 
Such errors can be removed by entanglement purification in the encoded space 
space, if the error rate is not too high. In particular, they can measure e % ^ x to 
see whether the position of the state is an even (bit value 0) or odd (bit value 1) 
multiples of y/n, or measure e~ 1 ^^ to see whether the momentum of the state 
is an even (bit value 0) or odd (bit value 1) multiples of \pii. Furthermore, 
they can directly measure x or p to conclude the bit value equivalently. In 
short, to do the secure QKD in position-momentum space with the encoded 
EPR states, Bob shifts his state according to the value announced by Alice 
and then together with Alice purifies the entanglement in the decoded space. 
Similarly, Alice may produce any displaced EPR state in the form 

d p )) = [/ ® D(^d x , ^d p )] ^(|00) + |11)). (258) 

Here the displacement operator D is defined in Eq.(35). After she sends the 
displaced parts to Bob, Bob measures x or p modulo y/n. Alice then announces 
the displacement d x or d p and Bob takes the reverse displacement to his states. 
On the other hand, it makes no difference if Alice measures her part in the 
beginning, before she sends anything to Bob. Thus, Alice need only prepare 
displaced encoded BB84 states in D(y/Trd x , y/irdp)(\0), 1))} space and sends 
them to Bob. Suppose she prepares N + m states among which N are prepared 
in {|0), |1)} basis and m are prepared in D(y/nd x , \/^d p ){-^ (|0) ± |1))} basis. 
Bob measures each of them either in position or momentum space and they 
will discard the data with basis mismatch. Also, Bob will revise his data by 
classical information of d p or d x from Alice. In particular, if Bob measures 
x, he does not need phase information, i.e., d p , therefore Alice does not have 
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to tell him this. This means Alice can actually choose a random value of 
< dp < 2y^u. Thus, if Alice decides to send Bob a displaced |0), she can 
actually sends him 

{ e i ^e" i ^ ?5 |0)(0|e i ^ ?5 e- i ^d?/. (259) 
Jo 

If we write it in position space, the factors for off diagonal terms are all after 
integration and the state is actually 

p(d x ,z = 0) = J2\ X = (2s + d x )V^){x= (2s + d x )V^\- (260) 

s 

Similarly, if Alice wants send Bob a state in position basis with bit value 1 
and displacement d x , she only needs to directly prepare the following state for 
Bob 

p(d x ,z = 1) = J2\ X = (2s+l + d x )^)(x= (2s + l + 4)v^l- (261) 

s 

Averaged over all possible displacement < d x < 2-^7?, Alice only needs to 
send random position states ! Due to the same reason, for those states in basis 
of states displaced from 77^ (|0) ± |1)), she can actually uses arbitrary momen- 
tum states. Therefore, the protocol actually only requires Alice to prepare 
random position states and random momentum states. A state with explicit 
position or momentum is not available in practice because it requires infinite 
energy. But one can prepare (finitely) squeezed states in either position space 
or momentum space. Such an imperfect source means excessive channel noise 
even they have a noiseless channel. However, as we shall show it later [145], if 
the initial state is sufficiently squeezed, the bit-flip error rate can be still less 
than 11% and one can distill some final key. 

Remark. In the security proof above, the EPR state in the encoded subspace 
is used as a mathematical tool. However, such type of encoded EPR state 
is unnormalizable. It should be interesting to seek alternative proofs which 
circumvents such unnormalizable states. 

4-6.2 Realization with squeezed states 

As we have pointed it out already, the infinitely squeezed states (position or 
momentum eigenstates) are unavailable since these states are un-normalizable. 
In practice, highly squeezed states would be quite technically demanding. An 
interesting question is the minimum squeezing demanded for the protocol with 
squeezed states. Say, if the source is not perfectly squeezed, there are errors 
due to the source itself. Also, the position x and momentum p should be 
always finite. A related question is how to choose the probability distribution 
of position and momentum. The perfect encoded BB84 states cannot be used 
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here because this means that with large probability that p, x should be very 
large. We want to reduce the protocol to the realistic case that the probability 
of using large position or momentum state will be negligibly small for large. 
This is indeed the case by a further examination of the security with a noisy 
source. 

In the entanglement distillation, it is only the error rate of the shared raw 
pairs that matters. The final key rate does not depend on how the errors of 
the shared raw pairs had been generated e.g., source error or transmission 
error, it only depends on the value of the error rate of those shared raw pairs. 
Alice and Bob need test the error rate of the shared pairs and then carry out 
the distillation protocol. Moreover, for the purpose of QKD, it doesn't matter 
if Alice measures her qubits in the very begining, i.e., the purification protocol 
is equivalent to a prepare-and-measure protocol with (noisy) bipartite states. 

As shown in Ref[145], we can make a secure protocol with two-mode squeezed 
states or directly produce single-mode Gaussian state which can also be pro- 
duced from a bipartite state in principle. 

We consider the case that Alice initially creates a two-mode Gaussian state in 
the form 
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where A is real and positive. In the case Alice measures position and obtain 
xa, she has prepared the following one-mode squeezed state for Bob: 
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(263) 



and 



and 



xbo 
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(264) 



(265) 



The probability distribution for the outcome of Alice's measurement can be 
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expressed as 



P{x A ) 



A 



exp (-A 2 x 2 A) 



(266) 



and we can easily see that if Alice and Bob both measure x, then the difference 
of their outcomes is governed by the probability distribution 



Prob(xA — xb) 



1 



V 71 A'- 



exp[-(x A - x B ) /A ] . 



(267) 



Also, if Alice measures her pulse in momentum space, she will have a proba- 
bility distribution of 



p(pa) = ^ exp (-Ay A 



(268) 



where A 2 



1 ^.4 A 4 • If she obtains p A , she has prepared the state 



MM) 



B 



(7rA- 2 )V4 



dxs exp 



\{PB 



PBO) 2 ^ 



(269) 



and 



p B o= \l-Af) l/2 p A - (270) 
We now ignore the noise due to channel and take a look at the the error rate 
due to the finite squeezing of the source. If \xa — xb\ < Alice and Bob 

still share the same bit- value since the bit- value is determined by the nearest 
integer of multiples of y/ir. However, if \xa — xb\ > there will be a 

bit-flip error. Therefore the bit-flip error rate caused by the imperfect source 
is 



2A 

P(\x A -x B \ > y/n/2) < exp(-7r/4A 

7T 



(271) 



If A < 0.486, the error rate from the source is less than 1% which is sig- 
nificantly below the threshold value 11%. We also have the similar result for 
bit-flip error rate in momentum space. The effect of channel loss and other 
imperfections can also be studied in a similar way [145]. 

Also, it makes no difference if Alice directly prepares the single-pulse states for 
transmission rather than first preparing bipartite states and then measuring 
her pulse in BB84 basis, if the directly created single-pulse state is identical to 
that of half of bipartite state. This is to say, Alice can obtain secure final key 
even she uses a noisy single-pulse source which produces po,i,+ - as the noisy 
BB84 states, provided that in principle there exists a bipartite pab which has 
the following property: If we measure photon A of pab in Z basis and obtain 
|0) or |1), state for photon B will become po or Pi accordingly; if we measure 
photon A in X basis and obtain |+) or |— ), state for photon B will become 
p + , p_ accordingly. Explicitly, we have the following final protocol for QKD 
with squeezed states[145]: 
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1: Alice sends a number of displaced squeezed states to Bob. Most of her 
states are squeezed in position. For those position squeezed state, Alice 



then sends Bob these states. 
2: After receives the states, Bob measures each one in either position basis or 
momentum basis. 

3: Bob announces his measurement basis for each state. Alice asks him to 
discard those data from a wrong basis. 

4: Alice announces the value x, modulo y/n. Bob subtracts Alice's value from 
his own measured value, and corrects to the nearest integer multiple of y/n. 
Bob and Alice extract their shared bit according to whether the integer is 
an even number or an odd number. 

5: They then do the error test in two level space. If the error rates are not too 
large they go on to do the final key distillation, otherwise, they abort the 
protocol. Bob announces bit values of all those bits obtained from measure- 
ment in momentum basis and the same number of bit values from position 
basis. The remaining bits are all from position basis. They distill the final 
key by the method in section 4.1, including error correction and privacy 
amplification. 



5 Mathematical theory of quantum entanglement with Gaussian 



In this section, we review the entanglement properties of Gaussian states of ra- 
diation fields. Firstly, we introduce a notion of quantum entanglement with its 
basic properties - separability and distillability in Section 5.1, where we note 
that the partial transposition plays a key role in the entanglement theory. Sec- 
ondly, in Section 5.2, we review the entanglement properties of Gaussian states 
focusing on the qualitative aspects. These properties include the description 
of partial transposition of Gaussian states, necessary and sufficient conditions 
for the separability and distillability of bipartite Gaussian states, and classi- 
fication of tripartite Gaussian states. We also point out that Gaussian states 
cannot be distilled by Gaussian operations with classical communication. This 
section is ended with a concluding remark. 




( 
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5. 1 General Properties of Quantum Entanglement 

First of all, we introduce the notion of quantum entanglement [191] and briefly 
review its general properties. The notion of quantum entanglement comes from 
the nonlocal properties of a wave function in the Hilbert space composed of 
local Hilbert spaces, Ti = TCa <8> Hb ® • • • ■ A notable example is the wave 
function |^_) = (|0) A |1) B - \ l) A |0) B ) /V2 in the Hilbert space H = Ha^Hb 
with dim?^ = dim7i B = 2. Here, {|0) A ^ , |1) A ( B )} is the orthonormal basis 
of Ha(b)- This wave function cannot be written as a separable form \x) A ® |x) B 
for any local wave functions \x) a anc ^ \x)b- ^ state described by such a wave 
function is called an entangled (pure) state. A statistical mixture of pure 
states is called a mixed state. Whether such a state is entangled or separable 
is defined as follows [192]. 

Definition 1.- A state described by a density operator p (or simply a state p) 
is called separable if it can be written as the convex sum of the tensor products 
of local density operators, 

f. 

P = Y< X iPA®P l B, (272) 
i=i 

where < A, < 1 and J2i=i Aj = 1. Otherwise it is called an entangled state. 

To make the following arguments as plain as possible, we confine ourselves 
to the bipartite case here; we consider only the states on the Hilbert space 
composed of two local Hilbert spaces. 

To distinguish whether a given state is separable or entangled is one of the most 
difficult problems in the entanglement theory and much work has been devoted 
on this subject [193,194,195,196]. The following theorem is fundamental on the 
separability problem [197]. 

Theorem 4-~ Let p be a density operator on the composite Hilbert space 
U = U A ® H B - If p is separable, then p TA > and p Ts > 0. 

Here, p TA is defined as pj£ kl = (vjV k \ p \viVi) = p jKih where \vtVj) = \vi) A ®\vj) B 
denotes an orthonormal basis vector in Ti. with {K)yi( B )} being the orthonor- 
mal basis of Ha(b)- That is, p Tjv is a partial transposition of p on the subsys- 
tem A. p TB is also defined similarly. We say that a state p is PPT (Positive 
Partial Transpose) if p TA > and p Ts > 0. Otherwise it is called NPPT (Non- 
Positive Partial Transpose). Theorem 4 assets that separable states are always 
PPT. It is proven that a PPT state in Ti = Ha ® 7~Lb with dim7i,4 = 2 and 
dimTi,B = 2, 3 is separable [198]. However, there exists a PPT but entangled 
state in higher dimensions [199]. 
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Distillation of quantum entanglement is an operation that extracts a pure max- 
imally entangled state from a several copies of a given state by local quantum 
operations supplemented by classical communication (LOCC). If there exist 
an LOCC operation A LOC c an d n, m e N such that 

Tr[(|^_> <^_|)® m A LOC c(p® n )] < 1 ~e 

for arbitrary e, then the state p is called distillable [200]. Here, p® n is the 
abbreviation of 

p <E> • • • <g> p. 
n 

Because only a maximally entangled pure state provides a reliable task in 
quantum information processing such as quantum teleportation [4] and quan- 
tum cryptography [147], the distillation is of practical significance and the 
distillability is an important characterization of an entangled state. 

All physically admissible operations are allowed for local quantum operations; 
they include local measurements/transformations of the state, adding/removing 
an auxiliary local system (ancilla), etc. Only classical information on the local 
operations can be exchanged through classical channels (Fig. 18). The direct 
transfer of the local states is strictly forbidden. Evidently, entanglement can- 
not be created by LOCC; it is inevitably degraded during the LOCC processes. 
A distillation procedure maximizes the amount of entanglement of a part of 
given states while destroying the rest of them. 




Fig. 18. Procedure of LOCC. 



If p is separable, evidently p is not distillable. However, an entangled state p 
is not always distillable. One of the most useful criteria for distillability is the 
following. 

Theorem 5.- A PPT state is not distillable. 



Ill 



Although it is conjectured that the converse of this theorem is not the case 
in general, the following partial result is known [201,202]. Let p be a den- 
sity operator on the composite Hilbert sp&ceHA <8> 7~Lb with dim Ha = 2 and 
dim7Y^ > 2. Then p is distillable if it is NPPT. As mentioned beforeCPPT 
but entangled states exists, but Theorem 5 asserts that such entangled states 
are still undistillable. Such states that are entangled but undistillable is called 
a bound entangled state [199,203] whereas distillable states are called free en- 
tangled states. It is an open question whether or not NNPT states are always 
distillable (Fig. 19). 



Fig. 19. States on a bipartite Hilbert space. Separable, PPT-BECNPPT-BECand 
FE stand for separable states, PPT bound entangled states, NPPT bound entangled 
states, and free entangled states, respectively. 



There are several distillability criteria other than the PPT criterion [204,205,206,207,208]. 
Among them, the most frequently used is the following reduction criterion 
[207,208]. 

Theorem 6.- If 



then the state p is distillable. 

For example, it can be shown that a phase-damped two-mode squeezed state 
[209] is always distillable by Theorem 6 [210]. We use this reduction crite- 
rion in the proof of the distillability of NPPT bipartite Gaussian states in 
Section 5.2.2. 

5.2 Entanglement Properties of Gaussian States 

Quantum entanglement of the radiation field is a quantum mechanical correla- 
tion between modes of the field. In the following we focus on the fundamental 
properties of entanglement of Gaussian states, i.e., the separability and distil- 
lability [28,211] and review the results obtained so far in depth. Although we 
deal with bipartite Gaussian states in most part of the following arguments, 





(273) 
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we also give a brief overview on the separability of mutipartite Gaussian states 
in Section 5.2.1. 



Let p be a bipartite Gaussian state shard by Alice and Bob and modes 
be in the possession of Alice (Bob). We call the state p the state of x % 
modes (or n^xn^ state) by convention (The total number of modes is n = 
n A + n B ). 

In Section 5.1, we observed that the partial transposition is an important tool 
to characterize the entanglement properties of a given state. So the question is 
how to describe the partial transposition for radiation field systems. In order to 
answer this, we note the fact that the transposition of the density operator p is 
given by p T = p*. Hence, the canonical variable P = —id/dQ changes its sign 
while the canonical variable Q remains unchanged under the transposition. 
As for the covariance, the partial transposition causes the replacement ■jjk — > 
—^jk if one of the two indices j and k refers to the modes undergoing the 
transposition. For a % x % Gaussian state p, the covariance matrix of p TA is 
given by 7 = F7F, where F = F A ® F B with F A = ®^ 1 diag(l, -1). Hence, 
the necessary and suffcient condition for p TA describing a physical state, or 
equivalently, p being PPT is 7 + iJ > by Theorem 4. Here, J a © Jb with 
Ja(b) — ®j=[ B) Ji- This condition is also rewritten as 7 + iJ > 0, where 
J = FJF = {—J a) © Jb- Therefore, we have the following. 

Theorem 7.- A Gaussian state is PPT if and only if its covariance matrix 7 
satisfies 7 + i J > with J = (—J A ) © Jb- 

Note that the displacement in the characteristic function or Wigner function 
can be set to zero by local canonical transformations. This means that the 
displacement is irrelevant to the entanglement properties of the states, so we 
can assume that it is zero without loss of generality. 

First of all, we discuss the separability of a 1 x 1 mode Gaussian state, which 
is a starting point in the following discussion. For a 1 x 1 Gaussian state, 
it is possible to make its covariance matrix to take a simple form by local 
canonical transformations on local canonical variables. Note that the entan- 
glement properties are completely preserved under such local transformations. 
Furthermore, a physical state is always physical under these transformations. 

The covariance matrix of a Gaussian state of 1 x 1 mode is written as 



Here, A, B, and C are 2x2 real matrices, and A = A T > 0, and B = B T > 0. 
From the Williamson's theorem (Theorem 6), there exist symplectic matrices 
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Sa and Sb such that SaASa = diag(n a , n a ) and SbBSb = diag(ri6, where 
n a , rib > 0. By the symplectic matrix © Sb, we have 



(SU © S B h(S A © Sb) 7, = diag(n a , n a , n b , n h ) + 




with C = SaASb. Next, we choose orthogonal matrices Oa,Ob £ 0(2) such 
that .fT = OaCOb is the singular value decomposition of C: K — di&g(k x , k p ) 
with (k x > k p > 0). If Oa(b) is not symplectic, Oa(b) = OA(£)diag(l, — 1) 
turns out to be symplectic. According to the replacement Oa{Ob) — > Oa{Ob), 
we have K — > diag(k x ,±k p ), which is still diagonal. Namely, by choosing 
A ,0 B e Sp(2,R) n 0(2), we have A CO T B = diag(k x ,k p ) with (k x > \k p \). 
Note that A (B)diag(n a (;,), n a ( 6) )05 (B) = diag(n a(6) , n a(6 )). Putting all things 
together, the covariance matrix of the original state is transformed as 



7 - (S' A © S^bO^ © 



(n o ^ 0^ 
n a k p 
k x rit, 

\ k p n b j 



(274) 



by the local symplectic transformation S'a(BS' b with S' A ^ = Oa(b)Sa{b)- The 
matrix in the right-hand side of Eq. (274) is called the standard form of the 
(lxl mode) covariance matrix. From Theorem 1, we have the following. A 
lxl Gaussian state is a physical state if and only if the four parameters in 
its covariance matrix in the standard form satisfies 



d x > 1 



(275) 



and 



d x d p + 1 > n„ + n h + 2k x k 



x rvp. 



(276) 

Here, d x ^ = n a rib — ^j(p)- Furthermore, from Theorem 7 we observe that the 
stats is PPT if and only if 



d x d p + 1 > n n + n h — 2k x k 



(277) 



in addition to Eqs. (275) and (276). Equivalently, the state is NPPT if and 
only if 

d x d v + 1 < n 2 a + n 2 b - 2k x k p (278) 
in addition to Eqs. (275) and (276). 



Since det Sa = det Sb = 1, det A, det B, det C, and det 7 are invariant under 
the transformation [Eq. (274)], and these are given by det A = n 2 al det B = 
det C = k x k p , and det 7 = {n a rib — k 2 )(n a rib — k 2 ). If det A = det B, we call 
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the Gaussian state symmetric. When the state is asymmetric, the fluctuations 
of canonical variables are not balanced between mode A and B as seen from 
the definition of the covariance [Eq. (18)]. For example, if n a > n b , (Q"a) = 
(P|) > (Qb) — {Pb)i or equivalently, the photon number of mode A is larger 
than that of mode B; (a) A ciA) > (ciB a B 



The Wigner correlation matrix also acquires the standard form by local canon- 
ical transformations; 

( N a K x N ^ 
N a K p 
K x N b 



7 



(279) 



K p N b j 



where K p > \K X \ > . A 1 x 1 Gaussian state is a physical state if and only 
if the four parameters in its Wigner correlation matrix in the standard form 
satisfies 

(280) 



D X <1 



and 



Here, D x( , 



D X D P 



1 > A„ 2 



N 2 b 



2K X K P . 



(281) 



x(j>) 



N a Nb — K x ( p )- Furthermore, the stats is NPPT if and only if 



D X D P 



1 < A„ 2 



2K x K p 



in addition to Eqs. (280) and (281). 

Contrary to the covariance matrix, if N a > N b , the photon number of mode 
A is smaller than that of mode B; (a^a^) < la B a B 



5.2.1 Separability 

Firstly, we discuss the separability of Gaussian state of 1 x 1 mode. To be- 
gin with, we note the following fact. As discussed in Section 1.2, a bipartite 
Gaussian state admits the following P representation: 

p = J d 2 ad 2 (3P(a, fi) \a, (3) (a, (3\ . 

If the P functions P{a,j3) are positive, the state is a statistical mixture of 
separable states \a,(3) (a,(3\ = \a) (a\ ® \(3) ((3\ so that the state is separable 
by Definition 1. For a bipartite Gaussian state, the P functions are calculated 

as 
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x exp(zv / 2Ima^ 1 + i\/2Rea£ 2 + iV2Jm/3^ 3 + iV2Re(3£ 4 ) 
1 

x exp 



-^(r-i 4 )£ 



The the P functions P(a, (3) are positive if V > I 4 or 7 > I 4 . This observation 
leads to the following lemma [212]. 

Lemma 1.- Let 7 be a covariance matrix in the standard form [Eq. (274)] for 
a 1 x 1 Gaussian state. If k x k p > 0, then the state is separable. 

Proof. If k x k p > 0, k x > k p > 0. Firstly, let us consider the case k x > 0. We per- 
form two successive local canonical transformations Si = diag( 
with x > and S 2 = diag(y, y -1 , y, y" 1 ) with y > to the canonical variables. 
These symplectic transformations correspond to local squeezing operations 
[see Eq. (21)]. The covariance matrix 7 is changed to 



/ 2 2 
' y z x z n a 



i = S^SrySf S 2 



y 2 k x 



\ 



y 2 x 2 n a y 2 k p 



\ 



y 2 k x y 2 x 2 n b 
y~ 2 k p y~ 2 x 2 n b J 



This matrix is decomposed into the matrix on the Qi,Q 2 plane and that on 
the Pi, P 2 plane. The matrix on the Qi,Q 2 plane is 



(„2 



iq = y 



X Tl a k x 



\ k x X 2 Tli ) 



while the matrix on the Pi, P 2 plane is 



ip = y 



( _ 2 , 

i kp X H/fa 



Because n a ,n b > 0, k x > 0, and k p > 0, we can choose x such that 7q7p = 
7p7q: x = (k x n a + kpUb) 1 ^ / \k p n a + k x n h ) x l^. Since the two commuting matri- 
ces 7q and 7p can be diagonalized simultaneously by a common orthogonal 
matrix, 7' can be diagonalized as 7" = S^i'S T = diag( _) by the 
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orthogonal matrix of the form 



S = 



( 


cos 9 





— sin 9 












cos 9 





— sin# 






sin# 





cos 9 







V 





sin 9 





sin# 


/ 



Here, 

k± = ^y 2 |x 2 n a + x~ 2 n b ± yj (x 2 n a - x~ 2 n b ) 2 + 4A^j 

and 

k'± = -y~ 2 [x~ 2 n a + x 2 n b ± yj {x~ 2 n a - x 2 n b ) 2 + 4^} . 

It is easy to see that SJS T = J, i.e., the orthogonal matrix S is symplectic. 
Since SS2S1 is symplectic, the transformed state is still a physical state so 
that the covariance matrix 7" satisfies 7" + i J > by Theorem 4. This means 
K-k'_ > 1. If we choose y such that k_ = k'_, k + ,k' + > K- = k'_ — 1, i.e., 
7" = S'-f'S 7 ' > I4. From this we have 7' > I4 by noting that S is orthogo- 
nal, and therefore 7' is a covariance matrix for a separable state. Since the 
separable state with the covariance matrix 7' is obtained by local canonical 
transformations from the original state with the covariance matrix 7, the orig- 
inal state is also separable. Secondly, we consider the case k x = 0. In this case, 
k x = k p = and 7 = diag(n a , n a , n b , n b ). By Theorem 4, we have n a ,n b > 1. 
Hence, 7 > I4 and 7 is a covariance matrix for a separable state. □ 

Now let us prove the following Simon' theorem [212]. This result has been also 
obtained by Duan et al. independently [213]. 

Theorem 8.- A Gaussian state of 1 x 1 mode is separable if and only if it is 
PPT. 

Proof. Since the separable states are always PPT by Theorem 1, it suffices to 
prove that the PPT condition implies the separability. Firstly, let us assume 
that k x k p < in the covariance matrix of 1 x 1 Gaussian state p written in the 
standard form [Eq. (274)]. If p is PPT, the partially transposed state p TA is 
a physical state; p TA > 0. The covariance matrix of p TA is given by Eq. (274) 
with k p —>■ —k p , so that p TA is separable by Lemma 1. Therefore, the original 
state p is also separable. Secondly, we consider the case k x k p > 0. The state 
is separable by Lemma 1 and Eq. (277) is always satisfied due to Eq. (276). 
Therefore, we conclude that the PPT condition implies the separability. □ 

For general bipartite Gaussian states, we have the following necessary and 
sufficient condition for separability [214,215]. 
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Theorem 9.- A Gaussian state with covariance matrix 7 is separable if and 
only if there exist covariance matrices ^a and 7^ such that 



7 > 1a © 7b- 



^282) 



Proof. Suppose a bipartite Gaussian state p is separable: p = J2k ^kp\ 
The covariance of p is calculated as 



Pb- 



lap 



a/3 



2 Ajtm^m^ - 2m a m /3 , 

k 



(283) 



where 1a(b) ls ^ e covariance matrix of Pa(b) and m, 



Tr (pi? Q ) = E fc A fc Tr (p A © p^i? a 
Afcm^ . Here we define a matrix A = 7 — J2k^k (ia^Ib)- By noting 
J2k Afc = 1 and using Eq. (283), it is easy to see that £ T A£ = J2k 1 ^k^i(sk — 
Sl f > for every vector £ £ R 2/ , where Sfc = E^&m*. That is, the ma- 
trix A is positive (semi-)definite. Hence, we have 7 > 7a © 7b by choosing 
1a(b) = Sfc Afe7^(m- Conversely, let us suppose that 7 > 7a ©7s- That is, 7 is 
written as 7 = 7^ © 7b + -P with P > 0. Let cr(d) be a density operator with 
the covariance matrix 7^ © 7^ and the displacement d: 



a(d) oc J d 2n £exp 



7B ) J( + i(Jd) T t 



Note that o~(d) is separable. It is easy to observe 



d da(d) exp 



-d T P~ l d 



oc / d 2n £exp 



4 



M-0- 



W(-0 oc p. 



That is, p is a statistical mixture of separable density operators a(d) with 



positive weight exp 



-d^P^d 



. Namely, p is separable by Definition 1. □ 



Now let us define a minimal PPT state as follows [214]. If 7 + iJ > and 
7 + zJ > 0, 7 is called a PPT covariance matrix. Furthermore, the PPT 
covariance matrix 7 is called minimal if 7 = 7' for any PPT covariance matrix 
7' such that 7 > 7'. A Gaussian state with minimal PPT covariance matrix 
is called a minimal PPT state. Under this definition, we have the following 
[214]. 

Lemma 2.- A PPT covariance matrix 7 is minimal if and only if 

supp(7 + U) n supp(7 + iJ) = 0. (284) 



Here, suppM = {<3>|M$ ^ 0} denotes the support of M. 

Proof of Lemma 2. Let us suppose that the PPT covariance 7 is minimal. If 
Eq. (284) is violated, then there exists a vector £ e C 2 ^ such that tf(y+i J)£ > 
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0, i.e., 7 + i J > = eA for some e > 0. We also have 7 + i J > eA. Now let 
7' = 7 — eA. Since 7' + i J > and 7' + z J > 0, 7' is a PPT covariance matrix. 
However, it is not minimal because 7 > 7' and 7 ^ 7'. This contradicts our 
assumption that the PPT covariance matrix 7 is minimal. Therefore, Eq. (284) 
must be satisfied. Conversely, let us suppose that Eq. (284) holds. If the PPT 
covariance matrix 7 is not minimal, there exists a PPT covariance matrix 7' 
such that 7 > 7' and 7 7^ 7'. It is always possible that A = 7 — 7' be a matrix 
of rank one: A = £ft. Since i + iJ > 0, we have ^(7 + iJ)£ > £ f A£ > 0. We 
also have ^(7 + iJ)£ > 0. This means that £ G supp(7 + iJ) fl supp(7 + iJ), 
which contradicts Eq. (284). Therefore, 7 must be a minimal PPT covariance 
matrix. □ 

Note Hiat Eq. (284) is equivalent to ReMu ReAT = X. Here M = Ker(7 + iJ) 
and A/" = Ker(7 + iJ) and ReV^ denotes the real restriction of the complex 
vector space V; it consists of all real parts of vectors in V. This is a subspace 
of the phase space X. We have dimReA/" < 2/ since dim Re V = 2dimV A by 
definition of the real restriction. 

Now, let us prove the following theorem [214] that is the extended version of 
Theorem 8. 

Theorem 10.- A Gaussian state of 1 xiig modes is separable if and only if it 
is PPT. 

Proof. Since the separable states are always PPT by Theorem 1, it suffices 
to prove that the PPT condition implies the separability. In the following, we 
confine ourselves to the separability of minimal PPT states. If every minimal 
PPT state is shown to be separable, every PPT state is also separable by 
Theorem 9. Firstly, let us suppose that MdM ^ {0}. Then, there exists a 
vector $ such that^ e A/YW^ 7^ 0). Since $ satisfies (7+zJ)$ = (7+zJ)$ = 
0, we have (J — J)$ = 0. If we write the vector $ as $ = (x±, X2, ■ ■ ■ , ^2/) T 5 
(J — J)$ = (22, —Xi, ■ ■ ■ ) T = 0. This means that the first two component 
(Alice's part) of $ are zero; $ = (0,0) T © $ B ($ B 0). Here let X B denote 
Bob's phase space (dimX^ = 2/b) and Xq be a real restriction of Mb = 
Ker(7# + iJb)' Xq = KbMb- This is a subspace of the phase space Xb and is 
defined as the phase space of the subsystem C (dimX c = 2/c). For a vector 
$b G Mb, we write its restriction on the subsystem C as $c- Then, $ c satisfies 
(lc + iJc)^c — 0. Hence, dimA/e < dimAc- Here, Mc = Ker(7 C + iJc)- 
Therefore, dimXc = dimReA/^ = 2d\mMs < 2 dimAc < dimXc, i.e., 
dimXc = 2 dimA/'c = dimReA/c so that the state on the subsystem C is pure 
(see the comment below Theorem 5). This means that the state on the total 
system is written as Pa,b\c,c — Pa,b\c®Pc- So we can focus on the separability 
problem of the states pa,b\c of the smaller system and assume M H M = {0} 
in the following. Let us suppose that $(7^ 0) G M and $(7^ 0) G M. Note that 



119 



$ ^ A/". Since 7 is Hermitian, ^$,7$^ = ^7$,$^. By noting 7$ = -zJ$, 

7$ = -zJ$, and (iJy = iJ, we have —iJ&) = (—iJ$, = (<l, -zJ$^>. 

Namely, $ is orthogonal to (J — J)$: (J — = 0. Here, the vector 

(J— J)$ must be non-zero. Otherwise we would have (7 + 2,/)$ = (7 + iJ)$ = 
0, contradicting our assumption $ ^ TV". Since J — J = (2Ja)©0, (J— J)$ ^ 
means that Alice's part of $ is non-zero. Alice's part of $ is also shown to be 
non-zero. If dim A/" > 2, dim Ma > dim M > 2 so that there exist two mutually 
orthogonal vectors $1 = $^ © (0, • • • , 0) 6 M and <3> 2 = $a © (0, • • • , 0) G A" 
with ^ $^ 2) . Now, for a vector $ = $ A ffi(*,-- - ,*), both (J-J)$; = $^ 
and (J — J)$' 2 = $^ must be orthogonal to $. This means that three two- 
dimensional vectors, $^ , $^ , and $^ must be orthogonal to each other. 
This is impossible and we must conclude dim M = 1. It is also shown that 
dim M = 1 in a similar manner. So we have dimReA/" = dimReA/" = 2. 
Since 7 is a minimal PPT covariance matrix, ReA/" U ReA/" is identical to the 
phase space A (see the comment below Proof of Lemma 2). Hence, dim AT < 
dimReA/"© dimReA/" = 4. This means that dim A = 4 because dim A > 4. 
That is, A is a phase space of the lxl mode system. Therefore, the state is 
separable by Theorem 8 because it is PPT. □ 

Can we remove the restriction on the mode in the above theorem? Unfor- 
tunately and expectedly, we cannot do so. There exists an entangled PPT 
Gaussian states, i.e., a bound entangled bipartite Gaussian state. Such exam- 
ples (2 x 2) are shown explicitly by Werner and Wolf [214]. 

Theorem 9 gives a necessary and sufficient condition for the separability of 
all bipartite Gaussian states. However, it is a difficult task to check whether 
Eq. (282) holds or not for a covariance matrix of a given state. The following 
operational criterion devised by Giedke et al. make it possible to determine 
whether a given state is separable or not by a series of simple computations. 

We write a covariance matrix of a bipartite Gaussian state as 



To 



A Co 



Starting from this, we construct a sequence of matrices {■Jn}n=o according to 
the following nonlinear map: If 7^ — i J > 0, An+i = Bn+i = An — Re(Ajy) 
and Cn+i = — Im(Ajv)- Otherwise, 77V+1 = 0. Here, Xn = Cn(Bn — iJ^C^ 1 
and 

/ 



In 

Now, we have the following theorem. 



An Cn 
yC N Bn 
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Theorem 11.- 



(1) If for some N G N, we have — iJ \ ^ 0, then p is not separable. 

(2) If for some N G N, we have A N — | |Cjv| | op I — « > 0, then the state p is 
separable. Here, || • || op denotes the operator norm. 

In order to check the separability of a Gaussian state, we just apply the non- 
linear map 7 at — > 7at+i starting from 7 until (1) or (2) in Theorem 11 is 
met. 

The separability problem of bipartite Gaussian states has been thus completely 
solved. 

For mutipartite Gaussian states [216,217,218], the problem is not simple; there 
are many different ways in which each subsystem is entangled/disentangled to 
other subsystems. At present the classification problem of multipartite Gaus- 
sian states is solved only for the simplest system, a 1 x 1 x 1 tripartite Gaussian 
state [218]. 

Let us consider a Gaussian state composed of three subsystems A, B, and C, 
each of which holds only one mode. This tripartite state is also considered 
as a bipartite state if two subsystems A and B are grouped together for in- 
stance. We write such a bipartite state AB-C and say that the total system 
is divided into two subsystems AB and C by a bipartite cut between AB and 
C. Since a bipartite state AB-C is a 2 x 1 mode state, Theorem 10 can be 
applied. According to the number of bipartite states with different bipartite 
cuts exhibiting NPPT/PPT, we have the four different classes. 

Class 1: Fully inseparable states that is NPPT under all three bipartite cuts. 
Class 2: Partially inseparable states that is NPPT under two bipartite cuts 

but is PPT under the remaining one. 
Class 3: Partially inseparable states that is NPPT under one bipartite cut 

but is PPT under the remaining two. 
Class 4: States that is PPT under all three bipartite cuts. 

Continuous-variable analogues to Greenberger-Horne-Zeilinger states consid- 
ered in [217] belong to Class 1. Note that PPT under all bipartite cuts does not 
imply the separability. The last Class 4 is further divided into two subclasses. 

Class 4a: Entangled states pabc that cannot be written as the statistical 
mixture of product states as 

Pabc = E Va ® Pb ® Pc- (285) 

i 

Class 4b: Fully separable states that can be written as Eq. (285). 
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NPPT 




NPPT NPPT 
(a) Class 1 



PPT 





PPT 



NPPT NPPT 
(b) Class 2 




PPT 



PPT NPPT PPT PPT 

(c) Class 3 (d) Class 4a and 4b 



Fig. 20. Classification of 1 x 1 x 1 Gaussian states. 

Namely, we have five different entanglement classes for tripartite lxlxl 
mode Gaussian states in total (Fig. 20). States of Class 4a are tripartite bound 
entangled states. The complete criterion to distinguish between Class 4a and 
4b has been also obtained by Giedke et al. [218]. 



5.2.2 Distillability 



The classification of bipartite Gaussian states by distillability is completely 
solved and it is established that the NPPT condition is the necessary and 
sufficient condition for the distillability by Giedke et al. [219] 

Theorem 12.- A bipartite Gaussian state is distillable if and only if it is NPPT. 

Although, we cannot rule out the possibility of existence of undistillable (bi- 
partite) NPPT states in the general setting, the family of Gaussian states does 
not harbor such peculiar states. 

To prove this, we need three lemmas. 

Lemma 3.- An NPPT lxl symmetric Gaussian state is distillable. 

Proof. According to the reduction criterion (Theorem 3), if there exists a state 
vector \ip) such that 

(iP\Tr B p®I B - p\iP) < 0, (286) 
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then the state p is distillable. The covariance matrix of p is written in the 
standard form (274) without loss of generality: 



7 




Here, 7a = 7b = diag(n,n) and C = dia.g(k x ,k p ). By noting Ttb>V(— £b) 
2tiS^(^b), we can take the partial trace of p; 



= i / d ^ Aexp {-\^Ja1aJaU) w(-a). 



(287) 



Now, let us take a two- mode squeezed state as the state vector = 
(coshr) -1 J2™=o tanh™ r \n) A ® \n) B . The covariance matrix of the pure state 



takes the form 



5 



D T S f 



>B 

Here, 5a = $b = diag(cosh2r, cosh2r) and D = diag(sinh2r, — sinh2r). 

Ttb takes the form of the right-hand side of Eq. (287) with the replace- 

ment 7^ — > Sa- Now, we have 



M TtbP ® Ib |^> = Tr A (Tr B pTr B (^1) 
= (27rP / d ^ A I rf ^ exp ("^Mta-Za^i - -£a Ja$aJa£'a^ 
xTr A \W(-U)W(-&]. 

After integration, the result is \ Tr B p® Is IV') — 2[det(7A + <5A)] _1//2 - Similar 
calculations yield (V>| p |^) = Tr(p \<ip) (V>|) = 4[det(7+<5)]" 1 / 2 . Hence, Eq. (286) 
is written as [det(7A + Sa)]^ 1 ^ 2 < 2[det(7 + <5)] -1 / 2 , which turns out to be 
(n — k x )(n + k p ) < 1 for r — > oo. Here, we observe that the NPPT condition 
[Eq. (278)] yields (n — k x )(n+k p ) < 1 by noting k x k p < for inseparable states 
(Lemma 1). Therefore, Eq. (286) holds for the two- mode (infinitely) squeezed 
state |^) so that p is distillable. □ 

Lemma 4-~ An NPPT lxl Gaussian state can be transformed by LOCC into 
a symmetric NPPT lxl state. 

Proof. If the state is not symmetric, the photon number of one mode is larger 
than that of the other mode. So it is expected that the symmetrization can 
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be achieved by equalizing the photon number by mixing the mode of larger 
photon numbers with a vacuum mode of physically minimal photon numbers. 
In the following, we show that this local operation can be done successfully 
under the NPPT condition. We write the Wigner correlation matrix 7^ of the 
state in the standard form [Eq. (279)] with N a > N b . The Wigner correlation 
matrix of the vacuum mode used as an ancilla is given by 7^, = diag(l, 1). 
The displacement of the vacuum mode is always zero. Now, let us make a local 
compound system B+ancilla to pass through a beam splitter. In the language 
of phase space, we apply a symplectic transformation S = 1 A © S bs on the 

Here, 



la 



Wigner correlation matrix of the total system, 7^ +an , 
the symplectic matrix S bs is given by Eq. (20). The Wigner correlation matrix 
lAB+anc is changed to 



1ab+ anc 



S T 1 AB+ancS 



M AB C 
C T M nn 



(288) 



where, 



M AB 



C 



N a 



N n 



cK x 




cK x c 2 N b + s 2 



cK p 




cK p 

1 sK x 



sc{N b - 
1 



c 2 N b + s 2 

\ 

sK p 
1) 

sc(N b -I)) 



and 



diag(c 2 + s 2 N b , c 2 + s 2 N b ) 



(289) 



(290) 



with c = cos 8 and s = sin 9. The Wigner function for the state of 
system is given by 



(291) 
the total 



WAB+anc{XA j PA 1 ^BiVBi ^anci Vane ) 
1 



7r 3 Jdet i Am 



exp 



( X A, ■ • • , Panc)l AB+anc{ X ' " * ,Panc) J 



(292) 



If we measured the P-quadrature of the ancilla with the measured result po, 
the Q-quadrature of the ancilla would be completely uncertain and the Wigner 
function would take the form 

W A b{xA,PA,Xb,Pb) = / dx anc W AB+ anc{xA,--- 
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Substituting Eq. (292) with Eqs. (288), (289), (290), (291) into the above 
equation and performing Gaussian integration, we obtain 



W AB (x A , ■■■ ,Pb) oc exp \ -(x A , ■ ■ ■ ,p B )M AB (x A , ■ ■ ■ ,p B f 

where, 

( M A C 



M AB 
with 



{C 1 M B 



(293) 



and 



M B = diag(c 2 iV fe + S 2 - s2c2(iV6 




s 2 N b + c 2 

In order to put the state with the Wigner correlation matrix Eq. (293) sym- 
metric, det M A = det M B must hold. This yields 

N 2 - N 2 

This equation has a real solution for 6 only when N b —D x N a > since N a > N b . 
Here, we note that N b -D x N a > is equivalent to (N b — D x N a ) (N a — D p N b ) > 
0, which turns out to be (N b - D x N a )(N a - D p N b ) = (N a K x + N b K p ) 2 > by 
Eq. (281). Therefore, there always exists a 9 satisfying Eq. (294). The proof 
is thus completed. □ 

Lemma 5.- An NPPT n A x n B Gaussian state can be transformed by LOCC 
into a 1 x 1 NPPT state. 

Proof. Let 7 denote the covariance matrix for an NPPT Gaussian state of 
n A x n B modes. Since the state is NPPT, there exists a vector £ G C 2< - nA+ns - ) 
such that 

^(j + iJ)^ < -e < (295) 
for some e > by Theorem 7. J is again given by J = {—J a) ® Jb- Here, 
we write £ = f W © ^ and = & A ' B ^ + i^ A ' B) (£f G M 2n ^ and 

£^ G IR 2ns ). It can be assumed that two vectors <^ A ' B ' ) and ^ A ' B ^ satisfy 
d AB)T J^' B) + 0. If ^ A ' B)T J^' B) = 0, we can replace by = 

£(A,B) + 6{A ,B)j^A,B) with 5 (A,B) ^ Q> go th&t ^,B)T^(A,B)/ ^ g and £ t ( 7 + 

-» ^(7 + *J)€ + 0(5 {A ^). Therefore, Eq. (295) still holds if \5^ A ^\ 
is sufficiently small. Now we construct local canonical transformations S A as 
follows. We choose fj A ^ (j = 1,2, ••• , 2n A ) such that JaI^-i = $jki 
/ifl-W^ = ti? T JAf { 2 t ] = (j,k = 1,2,..- ,n A ) with f[ A) = ^ and 
f% = — (£i^ T ^£i j -1 ^} ■ This is always possible and {fj A ^}^=i constitutes 
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a basis of the local phase space Xa [31]. Here, we define S^e^ = /j (j 



1,2,--- ,2n A ) for e! A) = (1, 0, 0, • • ■ , Of, e^ J = (0, 1, 0, • • ■ , Of , • ■ ■ e 



The matrix 5a (and 5j) thus defined is shown to be symplectic. The matrix 
Sb is also defined in a similar manner. A vector defined as t\a = (S'J)~ 1 ^ < - A ' ) 
takes the form aA&i^ + &aC2 by definition of 5a, where oa, &a G C. In a sim- 
ilar manner, a vector 775 = (5#f is written in the form clb^i + i>B&^\ 
where as, &b G C. Now, we apply the local symplectic transformation 5a ©5# 
on 7; 

Y = (5 A © 5 b ) 7 (5a © 5 s f . (296) 
By noting (S A © S B )J(S A © 5 B f = J, Eq. (295) is rewritten as 

+ iJ)rj < 0, (297) 



where = t}a@t}b- Since all components of vectors t]a and 7/b other than their 
first two are zero, Eq. (297) is further rewritten as 



V'Klred + iJredW < 0, 



(298) 



where 77' = (a a, &a) t © (as, 6b) 



7red 



'1,1 



7 2 ,i 



7i,2 
7 2 ,2 



7l,n A +l 



7l,n 4 +2 



72,n A +l 72,n. 4 +2 



7n.4+l,l 7n J 4+l,2 7nA+l,n.4+l 7n J 4+l,riA+2 
V7n A +2,l 7n A +2,2 7n A +2,nA+l 7n A +2,nA+2 / 



and J re rf = (— Ji) © Ji. 7 rec j is the covariance matrix of a 1 x 1 state that is 
obtained by local canonical transformations [Eq. (296)] followed by tracing out 
the local modes other than the first one at each local side. Since the sequence 
of these operations is LOCC, it partially destroys the entanglement of the 
state. However, the resulting state is still NPPT owing to Eq. (298). □ 

Proof of Theorem 12. Since distillable states are always NPPT by Theorem 
2, it suffices to show that the NPPT condition implies the distillability. If a 
tia x fis Gaussian state is NPPT, it can be transformed into a NPPT lxl 
Gaussian state by LOCC (Lemma 5). This state can be further transformed 
into a symmetric lxl Gaussian state by LOCC (Lemma 4). The resulting 
state is distillable by Lemma 3. □ 



Several distillation protocols for Gaussian states have been proposed so far 
[103,220,221,222]. For example, the protocol of Duan et al. utilizes the local 
quantum nondemolition measurement and distills Gaussian states to finite- 
dimensional maximally entangled pure states [220,221]. This scheme is physi- 
cally feasible but the experimental realization may be a long way off. So the 
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natural question is: Can we make a distillation protocol with local quantum 
operations that are much more tractable experimentally? One such a candi- 
date for local quantum operations is a Gaussian operation or Gaussian channel 
that maps every Gaussian state into a Gaussian state. The Gaussian opera- 
tion is shown to be implementable by linear optics with homodyne detection 
[223,224,225] that are experimentally accessible with current technology. The 
recent research work, however, have dashed this hope. It has revealed the fol- 
lowing discouraging fact: Gaussian states cannot be distilled by local Gaussian 
operations and classical communication [223,224,225]. This means that a dis- 
tillation protocol for Gaussian states must involve non-Gaussian operations at 
some stage. In the protocol proposed by Eisert et al. [103], a non-Gaussian op- 
eration is required only in the initial step and a series of Gaussian operations 
of [226] is applied in the subsequent steps. The non-Gaussian operation does 
not require too much; it consists of a single measurement that distinguishes 
between vacuum states and non-vacuum ones. 



5.3 Conclusions 



In this section, we have reviewed the entanglement properties of Gaussian 
states starting from the fundamental level. We have focused on the quali- 
tative characterization of Gaussian state entanglement, i.e., the separability 
and distillability and have given the complete proofs on several results. The 
important point is that the complete characterization by separability and dis- 
tillability has been established for bipartite Gaussian states. 

For the quantitative description of entanglement, some entanglement measures 
[227] are required. Among them, the logarithmic negativity (or negativity) 
is computable and is widely used in the theory of Gaussian state entanglement, 
although it is not a true entanglement measure in a rigorous sense [228] . The 
explicit formula of for a 1 x 1 Gaussian state can be written in terms of 
parameters of the covariance matrix in the standard form. General formula of 
other entanglement measures such as entanglement of formation (Ep), relative 
entropy of entanglement, and the distillable entanglement for general Gaussian 
states are not known yet. However, Giedke et al. give a closed formula for Ep 
of a 1 x 1 symmetric Gaussian state [229] . One of the biggest problem related 
to the entanglement measures is the additivity question of Ep, i.e., whether 
or not Ep(pi <S> P2) = E F (pi) + Ep(p 2 ). Is this additivity holds for Gaussian 
states? The answer is not known yet. 

We do not intend that this section is a comprehensive guide to literatures. 
So, many important literatures have been omitted in the references. Some of 
them are, however, found in the excellent review articles [230,50]. 
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6 Classical capacities of Gaussian channels 

In this section, we review the classical capacities of Gaussian channels and 
their properties. Firstly, we introduce basic ideas of classical information trans- 
mission via a quantum channel in Section 6.1, which includes the concept 
of mutual information, Shannon capacity, Holevo- Schumacher- Westmoreland 
capacity, and Holevo capacity. The dense coding scheme is also introduced. 
Secondly, we define the Gaussian channels and show the additivity property 
of a special case of Gaussian channel - a lossy or attenuation channel in Sec- 
tion 6.2. The explicit formula of the von Neumann entropy for Gaussian states 
is given and its properties are discussed. Thirdly, we discuss the properties of 
Gaussian channels with Gaussian inputs in Section 6.3, where we note that 
the Gaussian Holveo capacity is greatly simplified due to the special proper- 
ties of von Neumann entropy of Gaussian states discussed in Section 6.2. We 
mention the additivity properties of some Gaussian channels with Gaussian 
inputs. Finally, in Section 6.4, we review the dense coding with Gaussian state 
entanglement. 

6. 1 Classical Capacities of Quantum Channels 

In this section, we introduce basic ideas of classical information transmission 
via a quantum channel [1,231]. Suppose that the sender (Alice) has some mes- 
sages X = {xi,X2, ■ ■ ■ ,x n } that she wants to send to the receiver (Bob) by 
using a noisy quantum channel $. To this end, Alice encodes her message 
using a quantum state p x (x G X) with a priori probability p x . The input 
state p x is changed to &(p x ) at the output of the channel, where Bob de- 
code the message by measuring the received state $(p x ) by a suitable positive 
operator-valued measures (POVM) {E y } = {E\, E2, • • ■ , E m } with the proba- 
bility Tr(E y <&(p x )). The channel is completely characterized by the conditional 
probability p y \ x for the probability of obtaining y G Y given that Alice sent 
a message x G X if the channel is memoryless and the signal states p x and 
the POVM {E y } are fixed. In the memoryless channel, the signal states p x 
are independent of earlier or later usage of the channel. The probability of 
obtaining y G Y is given by p y = J2xPy\xPx and the joint probability of x G X 
and y G Y is computed as p x>y = p y \ x p x . The amount of information gained 
by Bob is given by the following mutual information, 

H(X : Y) = H(X) + H{Y) - H(X, Y) = H(Y) - H(Y\X), (299) 

where H{X) = — J2xPx^Px and H(X,Y) = —J2xPx,y^Px, y are Shannon 
entropies and 

H{Y\X) = Y,PxHiY\X = x) 

x 
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denotes the conditional entropy with H(Y\X = x) = — hip,^. Note 

that the mutual information [Eq. (299)] is written as 

H(X : Y) = Y,Px,y = Py\xPx^ Pj ^. (300) 

x,y Py 



One of the most important bounds on the mutual information is the following 
Holevo bound. 

H(X :Y)<S(p)-J2PxS(Px), 

X 

where p = J2 x PxPx- 

When the set of signal states {p x } and the POVM {E y } are given, the achiev- 
able classical capacity of a quantum channel is calculated as the supremum of 
the mutual information over all probability distributions of input signal states; 

C s ($) = supH(X : Y). (301) 

Px 

This is the quantum version of Shannon's noisy channel coding theorem and 
we call the capacity given by Eq. (301) the Shannon capacity. 

Yet, a further optimization over the quantum states to be sent and the POVM 
yields the ultimate information transmission rate. This defines the usual clas- 
sical capacity of a quantum channel. By noting entangled signal states are 
allowed for n invocations of the channel, the classical capacity of the quantum 
channel $ is calculated as 

C HSW m = lim -X(^ n ) (302) 

n— >oo 72, 



with 



(303) 



X($) = sup 

{Px,Px} 

where p = J2xPxPx and the supremum is taken over all probability distribu- 
tions and sets of states. This result is the content of the cerebrated Holveo- 
Schmacher- Westmoreland (HSW) theorem [232,233]. Hereafter we call the ca- 
pacity given by Eq. (302) the HSW capacity. The quantity defined by Eq. (303) 
is called the Holevo capacity. 

If the input is a product states p^ = p x> i ® p x> 2 ® • • • <8> p x ,n for n invoca- 
tions of channel <3>, then x($ m ) = so that C HSW (&) = x(®)- That is, 
the Holevo capacity x(^) gives the sing le-shot HSW capacity Cg^($). By 
definition, C^ sw (^) < Chsw(&)- However, it is conjectured that 



£*(*i) (304) 
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holds. This is called the additivity conjecture of the Holevo capacity [234]. If 
$j in Eq. (304) are identical for all i, we have Cjj SW ($) = Chsw{&)- Even this 
weak form of additivity question is still open for general quantum channels. 

The classical capacity can be increased if there is an additional resource in the 
form of an entangled state shared between Alice and Bob. Such an augmented 
capacity is called the entanglement-assisted classical capacity [235] . The dense 
coding [49] is the fundamental scheme of entanglement-assisted quantum com- 
munication. The transmission of classical information via a quantum channel 
in the dense coding scheme goes as follows. Initially, Alice and Bob share 
an entangled state pab- Alice performs a unitary transformation U m [or gen- 
erally a completely positive trace preserving (CPTP) map] on her state to 
encode the message and send the transformed state to Bob via the quan- 
tum channel. Upon receiving this transformed state, Bob combines it with 
his initially shared state and retrieve the message by POVM on the state 
{U m <S> lB)pAB{U m <S> 1b)- If the quantum channel is noiseless and the initially 
shared state pab is on the Hilbert space 'Ha®'Hb with dimli,A = dim7is = d, 
the optimal capacity of the dense coding is given by [236] 

C d = \nd+S(p B )-S(p AB ), (305) 

where ps = T^aPab and we have assumed the unitary coding. If pab is the 
maximally entangled state, pab = |^+) ("0+1 with = rf _1 ^ 2 Z)iLi K)^®^)^, 
then S{ps) — S(pab) = lnrf so that = 2 hid For d = 2, 2 bits of classical 
information can be transmitted by sending a single qubit. The capacity of 
Eq. (305) is based on the HSW theorem. If the signal states and the decoding 
scheme are given, the dense coding capacity is computed via the Shannon 
capacity [Eq. (301)]. 



6.2 Gaussian Channels 

A Gaussian channel $ is a CPTP map that transforms the Weyl operator 
= exp(i£ T JRy as follows. = exp{t£ T JR) as follows. 

W(O^W(XO exp (-^ T n), 

where X and Y are In x 2n real matrices Y is positive and symmetric {Y = 
Y T > 0). Here, we have assumed that both the input and output Gaussian 
are n mode state. The complete positivity of the channel is expressed in terms 
of these matrices as [237] 

Y + U n - iX T J n X > 0. 
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Among quantum channels for continuous variable systems, a Gaussian channel 
has its own significance. Namely, it corresponds to the so-called Gaussian 
operations that can be implemented by current experimental techniques such 
as beam splitters, phase shifters, squeezers, and homodyne measurements. 
Optical fibers in optical systems are well modeled by Gaussian channels. The 
covariance matrix is transformed according to 

7 0( 7 ) = X T 1 X + Y 7 (306) 

Hereafter, we write a Gaussian channel by a capital Greek letter and the 
corresponding transformation on the covariance matrix by the corresponding 
lower case Greek letter. 



The von Neumann entropy plays a fundamental role in the analysis of various 
capacities of quantum channels. The von Neumann entropy of a Gaussian state 
is given in terms of the symplectic eigenvalues of the state. Here, we derive the 
formula for the von Neumann entropy of a Gaussian state following [238,239]. 
We note that the von Neumann entropy can be computed as 

S(p)=-Vm±\\p\\ pt (307) 

where ||p|| = (Tr \p\ p ) l ^ p is the Schatten p-norm (p > 1) and |A| = V A^A. 
Without loss of generality, we can assume that the displacement of the Gaus- 
sian state is zero because of the unitary invariance of the von Neumann en- 
tropy, by noting that the the displacement of the Gaussian state can be always 
set to be zero by a unitary transformation. By virtue of Williamson theorem, 
the covariance matrix is written as 

n 

7 i > S-fS T = Vjl 2 (308) 

3=1 

with Vj G [l,oo) and S G Sp(2n, R). This symplectic transformation corre- 
sponds to a unitary transformation in the underlying Hilbert space. Therefore, 
a Gaussian state is unitarily equivalent to the state with covariance matrix 
given by the right-hand side of Eq. (308) and vanishing displacement, which 
is written as 

n 9 00 ( v - 1 \ k 

p = ®—i^ l^+T !*>«<*! (309) 

j=i u i ^ i k=Q VjTiy 
in the Fock space representation, where 

|A) =-L(a})*|0), fc = 0,l,-.. 



denotes the number state of the jth mode. Equation. (309) describes the state 
in a thermal equilibrium (the thermal state) with the average photon number 
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of the jth mode being [n)- = [yj — l)/2. From Eq. (309), we have 

n np 

Tr/=n 



,-=i Ui v i) 

with f p (x) = (x + l) p — (x — l) p . Therefore, form Eq. (307) 



s( P ) = ±g(^j 1 ) (3io) 



i=i 
with 



g(x) = (x + 1) ln(x + 1) — xlnx. (311) 
Equation (310) with Eq. (311) gives the von Neumann entropy of a Gaussian 
state p. 



Since 



1\ (X • Gin / 
\ J , . , I fn — 1 



\ Z/j + 1 J \ Vj + 1 

the state [Eq. (309)] is also written as 



A 2 /zA-lV^ 



It is evident from this equation that lnp depends linearly on rij = ajaj. This 
observation leads to the following important theorem [240]. 

Theorem 1. - Among all states with fixed covariance matrix, the Gaussian 
state is one which maximizes the von Neumann entropy. 

Proof. Let p be a Gaussian state with fixed covariance matrix. There exists a 
state p with the same covariance matrix. Without loss of generality, we assume 
that the displacements of p and p are zero. We thus have 

S(p) — S(p) = Trp(ln p — In p) + Tr(p — p) In p. 

The first term on the right-hand side is the nonnegative relative entropy and 
the second term vanishes since Tr (pa^a-^j = Tr {jja^a^ and lnp is a linear 

function of rij = OjCij. Therefore, we have S(p) > S(p). This completes the 
proof. □ 



Important examples of Gaussian channels are classical channels and thermal 
noise channels including lossy or attenuation channels. 

In the classical noise channel, a classical Gaussian noise is added to the input 
states. Since W(£)-RjWt(£) = Rj the classical noise channel is described 
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by 



(312) 

with Y > 0. In Eq. (312), P( 7/m ) stands for a Gaussian state with covariance 
matrix 7 and displacement m. Namely, the transformations of covariance ma- 
trix is given by 

d ( 7 )= 7 + F. 

In the thermal noise channel, the signal Gaussian states interact with an en- 
vironment that is in thermal equilibrium. This channel is modeled by beam 
splitters that couple the input Gaussian state and the thermal reservoir. Let 
cij and bj be annihilation operators of the jth mode of the singnal state p 
and the thermal state p t h that acts as a thermal reservoir. The action of the 
beam splitter is described by the transformations, aj t— > cos8jCij + sin6jbj and 
bj 1 — > — sin 9 jdj + cos 8 jbj. Accordingly, the corresponding symplectic trans- 
formation Sj takes the form of Eq.(20) with 9 = 6j, Therefore, the output 
Gaussian state has the covariance matrix, 

^( 7 ) = Tr t ,[^ 1 ( 7 © 7t / l )(^ 1 ) T ], (313) 

where 5* = 0" =1 Sj, 7^ = 0™ = i (2 (n) ■ + l) I 2 denotes the covariance matrix 
of the thermal state p t h with (n) • being the average photon number of the 
jth mode, and Tr t h describes the trace over the thermal state. The right-hand 
side of Eq. (313) is calculated as 

th ( 7 ) = X T 1 X + Y, (314) 

where 

^ = 0^2 (315) 
i=i 

and 

n 

Y = ® (2 {n)j + l) (1 - Vj )h (316) 

i=i 

with r/j = cos 2 9j being the transmittivity of the beam splitter. At zero tem- 
perature ((n)j = 0), the thermal noise channel is reduced to the lossy or 
attenuation channel [241,242]. 

At present, the additivity of Holevo capacity is proven and the HSW capacity 
is computed exactly only for the lossy channel among Gaussian channels[243], 
which is shown in the following. In the following discussion, we need the fol- 
lowing theorem [244]. 

Theorem 2. - Among all single mode states (that are not necessarily Gaussian) 
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with fixed average photon number, the thermal state is the one that maximizes 
the von Neumann entropy. 



Proof. The average photon number of the mode of frequency ui and therefore 
the energy E = Ti(pH) of the mode is fixed with H = u(a J< a + 1/2). The prob- 
lem is to find the state maximizing the von Neumann entropy S = — Tr(plnp) 
under the normalization condition Trp = 1. This is given by the solution of 
the variational problem 

5 [— Tr(plnp) — pTi(pH) — vTip] = 0, 

where /i and v are Lagrange multipliers. Direct computations yield 

with Z(j3) = Tr exp(— (3H) and j3 = (S/E) mSuX . That is, the state p is a thermal 
state that is in thermal equilibrium with temperature □ 

Let $ be a lossy channel that maps an m mode Gaussian state to an m mode 
Gaussian state. By definition, 



C H sw{$) > = sup 



(317) 



where p = J2 x PxPx- Since the states p x are infinite-dimensional states, the 
right-hand side of Eq. (317) becomes arbitrarily large if we do not impose 
some constraint on the signal states. Here, we take the energy constraint 

m 

5> fc iVk = £ (318) 

k=l 

and write Chsw(&, £) instead of Chsw ($) as the HSW capacity for the chan- 
nel $. In Eq. (318), uj], denotes the frequency of kth mode and Nj, stands 
for the average photon number of the kth mode of the average input state; 
Eq. (318) describes the constraint that the energy (excluding the zero point 
oscillation energy) of the average input state p should be £. 

Now we take the tensor product of coherent states 



p(m 1? m 2 , • • • , m m ) = P( %mi ) <8> P( 7 ,m 2 ) <S> • • ■ <S> P( 7 ,m m ) 

= |ai) (ai| <g> |a 2 ) (a 2 | <8> ■ • • ® |a m ) (a m | (319) 

for the input signal state and assume that the probability distribution of the 
displacement of the kth. mode takes the form, 
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instead of optimizing the signal ensemble in the right-hand side of Eq. (317). 
In Eq. (319), 7 = diag(l, 1, • • • ,1,1) and m k = y/2a k (k — 1, 2, • • • , m). 



The output state $>(p x ) is still a coherent state [245]. This is easily seen by 
Eqs. (314), (315), and (316). The average output state is calculated as 

/m 
Yl dm k Pk(m k )p(m lt m 2 , • • • , m k ) = p (7l0 ) <8> P( 72 , ) ® • ■ ■ ® P( 7m ,o), 
fc=i 

where 7^ = diag(H-2pfciVfc, l + 2r]kNk). That is, the state $(p) is a tensor prod- 
uct of thermal states with average photon numbers r) k N k (k = 1,2, •■ ■ , m). 
Since the state $(p x ) is pure, S ($(p x )) = so that 

m 

x k=l 



Therefore, we have 



C HSW (^,£) > vaax^g(ri k N k ), (321) 
Nk k=i 

where maximum in the right-hand side of Eq. (321) is taken for all N k satis- 
fying the energy constraint (318). 

Next, let {p* , p* } be the optimal signal ensemble, which gives the capacity 
C HSW ($). Since S (<5>® n (p* x )) > 0, we have 



C HSW (<$>,S) < lim -S(^ n (p*) 

n— >oo fi \ 



with p* = J2xP x Px- By the subadditivity of the von Neumann entropy [246], 
we have 

n m 
1=1 k=l 

where &(p k ) is the reduced density operator of the kth mode in the Zth 
realization of the channel, which is obtained from ^""(p*) by tracing over all 
the other modes and over the other n — 1 channel realizations. Now, let 
be the average photon number of the state p k 1 ' so that the average photon 
number of the output state $(pj^) is rj k N^' . Since among all states with this 
average photon number, the thermal state has the maximal von Neumann 
entropy (Theorem 2), we have 



s($(p k l) ))<g(ri k Nl l) ). 
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Therefore 

i n m 

C HSW {%E)<Yrm -£5>(%Af)> 
u 1=1 k=i 

where the summation in the right-hand side is taken under the constraint 

k=i 1=1 " 

Note that n" 1 £f =1 ^fc } = ^ is the average photon number of the fcth mode 
of the average input state. Since d 2 g/dx 2 = —l/[x(x+ 1)] < 0, g is concave so 
that 

i n m m In AT^' \ m 

-EE gimN?) < E 9\ E < E ^Mfc)- 
" j=i fe=i fe=i \/=i n ) k k=i 

Therefore, 

m 

C H sw(®,£) < nmxJ^giVkNk), (322) 
Nk k=i 

where maximum in the right-hand side is taken for all Nk satisfying the energy 
constraint (318) again. From Eqs. (321) and (322), we have 

m 

C H sw(®, S) = max V g(r]kN k ). 
Nk k=i 

The right-hand side is the energy-constrained classical capacity of the lossy 
channel. Note that the energy-constrained Holevo capacity is weakly additive; 
^ ($® n ) = n ^ ($) an( i the optimal signal ensemble is given by Eqs. (319) and 
(320). 



6.3 Gaussian Channels with Gaussian Inputs 



It is conjectured that the optimal signal states for Gaussian channels are 
Gaussian states [247]. However, it is not proven yet so that we have 

Chsw&S) >C g {$,£) (323) 

in general. Cg{®,£) denotes the HSW capacity of the Gaussian channel $ 
for Gaussian state inputs under the energy constraint specified by S, which is 
given in terms of the energy-constrained Holevo capacity for Gaussian state 
inputs or the Gaussian Holevo capacity [248], 



Xg($,£)= sup 

MiP(7,m) 



S($(jp)) - / /x(d7, dm)S($(pfr >m) )) 



(324) 



where 

p = I /i(dj, dm)p {l , m) 
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is the average signal state. In Eq. (324), the supremum is taken over all possible 
probability measures /i and signal states P( 7 , m ) constituting the signal ensemble 
under the energy constraint 

TipH = 8 (325) 

with 

n , 1 \ 1 n 

H = u k ( a\a k + - ) = - (Rlk-i + Rlk) ■ 

k=i v z/ z k=i 

The right-hand side of Eq. (323) is given by 

C G (*,£)= lim - XG (^ n ,^ n ). 

n—foo n \ i 



Some properties of the capacity of Gaussian channels are greatly simplified if 
we restrict the signal states to Gaussian ones. In the rest part of this section, we 
discuss the additivity properties of Gaussian Holevo capacity. Let us recall that 
the von Neumann entropy of a Gaussian state depends only on the covariance 
matrix, and that channel $ affects only the covariance matrix. Therefore, if we 
find a single state P( 7 *, m ) that minimizes 5*($(p)), all possible Gaussian states 
p with the covariance matrix 7* also minimizes S(&(p)). This observation 
indicates that the optimal signal ensemble that attains the Gaussian Holevo 
capacity consists of Gaussian states with the common covariance matrix 7* 
and a certain probability distribution of the displacement m. If we restrict 
the signal ensemble to that described above, it suffices to take a Gaussian 
probability distribution for the probability measure /i(g?7 , dm) = p,(dm). This 
is shown as follows [240]. If p J (dm) is a Gaussian distribution; 



pi{dm) 



7r n ,/det Y, 



exp(— rriFY^ 1 m)dm 



with Yfj, > 0, the average input signal state is calculated as 



p = / p(dm)p {l ^ m) = p (7 +y M ,o)- 



(326) 



That is, p is also a Gaussian state with the covariance matrix 7 = 7 + !^ and 
has the vanishing displacement. Equation (326) even holds for Y^ > 0. Since 
the displacement of p is zero, 



1 n 

TrpH = -5>* ((i4-i 
A k=i 



P 2 



1 - 

^ fc=l 



where 



7 W 



72fc-l,2fc-l 72fc-l,2fc 
\ 72fe,2fc-l 72fc,2fc 
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so that the energy constraint [(325)] is written as 

n 

5> fe lY( 7 + y M ) [fe] = 4£. (327) 

k=l 

Since such a signal ensemble described above is not always optimal, we have 
XG (®,£)> sup [Styfr + Yj) -5(0( 7 ))], (328) 

7,^(>0) 

where the supremum is taken under the constraint (327). In Eq. (328), S*(0(7)) 
stands for the von Neumann entropy of Ptj,M, the Gaussian state with covari- 
ance matrix 0(7). Hereafter, we have occasions to write the von Neumann 
entropy as £(7) instead of S(p 1 ) when we are dealing with Gaussian states. 
Note that the right-hand side of Eq. (328) is written as 

sup 5(0(7)) - inf ,S(0( 7 )) = sup 5(0( 7 )) - 5 min ($), (329) 

7 7 7 

where the supremum is taken under the constraint 

n 

Y, Tr^ fc 7W = 4£ . (330) 

k=l 

In Eq. (329), 

S min ($) = infS($(p)) 

defines the Gaussian mimimum output entropy and Q denotes the set of all 
Gaussian states. By Theorem 1, we can see that for Gaussian signal state P( 7 , m ) 
and the probability measure ^(d'jjdm), the quantity within the brackets of 
the right-hand side of Eq. (324) cannot exceed the value of the right-hand side 
of (328). Therefore, the equality holds in the inequality (328); 

Xg(®,£) = sup 5(0(7)) -5 min ($). 

7 

Again, the supremum is taken under the constraint [Eq. (330)]. 

Let 8 be the value for the energy constraint [Eq. (318)] for the Gaussian chan- 
nel $j and £ = J2JLi £j- From the definition, the Gaussian Holevo capacity of 
the tensor product channel is greater than or equal to the supremum of the 
sum of the Gaussian Holevo capacity of individual channels; 

m 

Xg(®,£)> sup J2xG{^j,£j). (331) 

Here, the supremum is taken over all possible combinations of £j under the 
constraint J^JLi^j = £■ If the equality holds in the inequality (331), we say 
that the energy-constrained Gaussian Holevo capacity is additive for Gaussian 
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channels $j. Now let p be a Gaussian state on the composite Hilbert space 
Td ® • • • ® H m and define = Tr Hl ®... mj _ imj+1 ®... mm p. By noting the 
subadditivity of von Neumann entropy [246], S(p) < Y^Li S(pj), we have 

m 

W)<E%-(7j)). 

i=i 

where 7^ denotes the covariance matrix of the Gaussian state pj. Therefore, if 
the minimal output entropy 5 , m ; n ($) is additive for the channels 

(m \ m 

3=1 ) 3=1 

then 

m 

xg(®,£)< SUp Y,XG($j,£j)- 

{£i}-E7=i £ i= £ i=i 

This implies the additivity of the energy-constrained Gaussian Holevo capac- 
ity; 

m 

XG {®,£)= SUp Y,XG($j,£j)- 

{ej},Y^ =1 £j=e 3=1 

Due to Eq. (307) the additivity of the Gaussian mimimum output entropy is 
implied by the multiplicativity of the Gaussian maximal output p-norm for 
p -> 1+- 



where 



u'=i / 3=1 



e P ($) = su P ||$(p)n p 

pee 



defines the Gaussian maximal output p-norm. 

Serafini et al. [239] proved that the Gaussian maximal output p-norm of a 
tensor product of identical single mode Gaussian channels and that of single 
mode channels described by X { and Yi [(306)] such that detXj are identical 
and Yi > for all i, are multiplicative for Gaussian state inputs for p > 1. 
Consequently, the Gaussian minimal output entropy and energy-constrained 
Gaussian Holevo capacity are additive for such tensor product channels. Hi- 
roshima [249] also proved the multiplicativity of the Gaussian maximal output 
p-norm of a tensor product of classical noise channels of arbitrary modes and 
that of thermal noise channels of arbitrary modes. Therefore, the Gaussian 
minimal output entropy and energy-constrained Gaussian Holevo capacity are 
additive for such tensor product channels. 

The additivity properties of Gaussian channels under Gaussian state inputs 
are shown to be equivalent to the additivity of Gaussian entanglement of 
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formation Eq defined by Wolf et al. [250] , which is an entanglement monotone 
under Gaussian local operations and classical communication (GLOCC) [216]. 
By definition, Eq is an upper bound for the true entanglement of formation 
Ep for Gaussian states. However, for symmetric two-mode Gaussian states, 
Eq coincides with Ep [250]. Furthermore, Eq is additive for symmetric states 



As mentioned earlier, only lossy channels within the class of Gaussian channels 
are proven to exhibit additivity properties - additvity of energy-constrained 
HSW capacity and the minimum output entropy. For general quantum chan- 
nels, the additivity question is still an open problem. Despite many efforts 
devoted to the additivity problems of quantum channels, the additivity prop- 
erties have been proven for a few examples, such as entanglement breaking 
channels [251], unital qubit channels [252], depolarizing channels [253], and 
contravariant channels [254]. 



6.4 Dense Coding with Gaussian Entanglement 

The dense coding scheme in continuous variable systems was discussed by Ban 
[72] and Braunstein-Kimble [73]. In this section, we introduce the Braunstein- 
Kimble's scheme of dense coding. 

Suppose that Alice and Bob share initially the two-mode squeezed state p\ 2 = 
U(r) |0) (0| U^(r), where U(r) = exp[— r(a\ai — a 2 a 2 )] is the two-mode squeez- 
ing operator with r being the squeezing parameter (r > 0). The mode 1 (2) 
is in the possession of Alice (Bob). The characteristic function of the shared 
state P12 is given by 



W(ai, ai) = — / d 2 r} x / d 2 n 2 exp^c^ - ^aj) exp(77*a 2 - r] 2 a* 2 )x(vii V2) 



where the subscript R{I) refers to the real (imaginary) part of ct\ ± a 2 . Now, 
Alice performs a unitary transformation, 



[250]. 



xivi, V2) = Tr[pi2 exp(?7ial - r/Jai) exp(77 2 a 2 - n* 2 a 2 )} 



so that the Wigner function takes the form, 




= — exp -e (ai-a 2 ) R -e (a 1 -a 2 ) I 

2r / \ 2 2r / \ 2 

-e [a\ + a 2 ) R - e («i + a 2 )j , 



D(a in ) = exp(a in a\ - a- n ai) 
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on the mode 1 to encode her message characterized by the displacement «j n . 
The state p\ 2 is transformed as 

P12 D(a in )p 12 D ] {a in ) = p 12 . (332) 

The characteristic fucntion of p' 12 is computed as 

x'(Vi,V2) = exp(-77*a in + r/ia* n ) 

so that the Wigner function of p' 12 takes the form, 

W'(ati, a 2 ) = W(a 1 - a in , a 2 ). 

After Alice send her state (mode 1) to Bob via a noiseless channel, Bob receive 
the state and he has the state of Eq. (332) in his hand. Bob's task is to decode 
Alice's original signal a{ n . To this end, Bob performs a unitary transformation 
on p' 12 represented by a 50-50 beam splitter; a\ — > (a± + a 2 )/v2 and a 2 — > 
(«i — a 2 )/ y/2. If he measured Reai and Ima 2 by an ideal balanced homodyne 
detection with the measured results am and a 2 j respectively, Ima^ and Rea2 
would be completely uncertain and the Wigner function of the state would be 
reduced to 



dlmai / dHea 2 W' 



a± + a 2 ai — a 2 



2e r 

— exp | — 2e r 

7T 



a 
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W"(a) 



where a = am + i&n- This represents a highly peaked distribution about 
the displacement ai n /y/2 and gives the conditional probability P(a\a in ) of 
obtaining a given an original message a in . Let a in be distributed as 



P(ou 



7TO" 



1 / \OLin\ 

— exp - 



Thus, the probability of obtaining a is computed as 

2 



Pa) 



d ai n P(a\a in )P(ai n) 



2 i „-2r 



ix [o + e 



exp 



2 \a\ 



a 2 + e 



-2r 



and the mutual information that is accessible to Bob is calculated by Eq. (300) 



as 



H d {A :B)= d 2 a in d 2 aP{a\a in )P{a in ) In 



P(a\a in ) \ 

Since the average photon number of mode 1 is given by 

n(a in ) = Tr (pi 2 al a i) = Win? + sinh 2 r, 



ln(l + aV r ). 



(333) 
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the average photon number of the average input signal state is computed as 
n = J d 2 a in P(a in )ri(ai n ) = a 2 + sinh 2 r. 

For fixed n, the mutual information [Eq. (333)] is maximized when a = 
V sinh r cosh r (n = e r sinh r) , yielding the dense coding capacity of 

Cd = ln(l + n + n 2 ) ~ 4r, r — > oo. 

Now, we recall that the thermal state maximizes the von Neumann entropy 
if the average photon number n of the mode is fixed (Theorem 2). Thus, 
the signal ensemble with pure signal states and the probability distribution 
such that the average input signal state is a thermal state achieves the HSW 
capacity of noiseless quantum channel under the fixed photon number; 

C H sw = g(n). (334) 

Substituting n = e r sinh r into Eq. (334), we find Chsw ~ 2r for r — > oo. That 
is, the dense coding sheme presented here allows twice as much as information 
to be encoded; Cd ~ 2Chsw for r — > oo. 

6.5 Entanglement measure 

7 Estimation theory for Gaussian states 

In this section, we treat state estimation theory in the three methods, the 
Bayesian method, the group covariant method, and the unbiased method. For 
the preparation of this topic, we first discuss information quantities for one- 
mode bosonic quantum system in Subsection 7.1. Next, we treat the measure- 
ment theory for this system in Subsection 7.2. In particular, the heterodyne 
measurement is explained in this section. In Subsection 7.3, we give the math- 
ematical formulation of the estimation theory. In Subsection 7.4, we consider 
the case many copies of the unknown state. Then, we show that the estima- 
tion problem with n copies can be resulted in the estimation with that with 
the single copy when the unknown parameter is the expectation of the filed 
operator of the unknown Gaussian state. We treat the estimation theory by 
the Bayesian method, the group covariant method, and the unbiased method 
in Subsections 7.5, 7.6, and 7.7, respectively. In these subsections, we show 
the optimality of the heterodyne measurement. Finally, we briefly treat the 
simple hypothesis testing in the Gaussian case. For the estimation theory for 
other state families and a more deep analysis of the simple hypothesis testing, 
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see Hayashi [231]. Since our analysis treats the estimation of displacement 
parameter, it can be extended to the estimation of displacement parameter 
for squeezed Gaussian states family whose elements are given by the Gaussian 
mixture of the squeezed states. For this extension, it is sufficient to replace 
the annihilation operator a by the operator cosh ra — e~ % ^ sinh ra^. 

7.1 Information quantities 

The essence of information theory is describing the operational bound based 
on the information quantities. Hence, as a preliminary, we need to give con- 
crete expressions of these quantities in the case of Gaussian states p^jj := 

-= J c |a)(a|e n da. In order to express the difference between two states, 
we often treat the relative entropy as 

D(p\\a) :=Trp(logp-a). 

Since the equation D(p\\a) = D(o~\\p) does not necessarily hold, the relative 
entropy does not satisfies the axiom of the distance. However, this value ex- 
press how large the difference between two state. Hence, it can be regarded as a 
kind of distance between two states. In the Gaussian case, it can be calculated 

D(p^\\p c ,n) = D(p ^\\p ( _ c ,jt) = iC-Cf log ^=Ji (335) 
As another quantity, Bures' fidelity 

F(p, a) := Tr \JyfpOyfp = Tr 

is known[255, 256, 257,258]. When the state p is a pure state \4>)(4>\, the its 
square equals the overlap probability between two states, i.e., 

F 2 (|0)(0|,a) = (0M0> 

Using this value, Bures' distance db(p, ex) is defined as 

d b (p,a) :=^1-Fi(p,a). 

It satisfies the axiom of distance. In the Gaussian case, this value is calculated 

as 

In order to treat the geometric aspect of the set of parametric set of states 
{po\ 9 G 6 C M. d }, we often focus on the metric of the family. This is because 
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the metric expresses the infinitesimal distance between two states. In the case 
of the set of probability distributions {pg(u)\9 G © C R}, Fisher information 



is used for this purpose in the one-parametric case. In the multi-parametric 
case, the metric defined from the Fisher information matrix: 

Jew ■= J — ^ w—rtu)** 

is used. This is because it is always equal to the constant times of Fisher 
information if a metric satisfies monotonicity for quantum operation. 

Hence, it is thought that Fisher information presents the information quan- 
tities. Moreover, using this property, we can characterize the bound of the 
accuracy of estimation by Fisher information. 

However, in the quantum state case, there are several information quan- 
tities satisfying this invariance. Hence, there is arbitrariness of the quan- 
tum version of Fisher information. This arbitrariness is caused by the ar- 
bitrariness of the quantum version of the logarithmic derivative. In the one- 
parametric case {pe\9 60C M}, three quantum versions are known. When pg 
is non-degenerate, one is the symmetric logarithmic derivative (SLD) Lg[259]: 
| (L e p e + pgL e ) = Other are the right logarithmic derivative (RLD) L e [260]: 
pLg = and the Kubo-Mori-Bogoljubov (KMB) logarithmic derivative 
L e [261,262]: L e = ^p. In the above definition, the SLD L e and the KMB 
logarithmic derivative Lg are Hermitian while the RLD Lg is not necessarily 
Hermitian. Based on these logarithmic derivatives, we can define three quan- 
tum analogues of Fisher informations, SLD Fisher information Jg»[259] , RLD 
Fisher information Jg[260], and KMB Fisher information Jg[261,262]: 

J e := Tr p d L 2 e , J e := Tr p e L e L\, J e := Tr p e L 2 e . (336) 

These information quantities are closely related to differences between two 
states. The SLD Fisher information Jg is characterized as the limit of Bures' 
distance[263,264]: 

4 

and the KMB Fisher information Jg is by relative entropy[261]: 

2 1 
J e = lim— D(p e || p e+€ ) = lim— D(p e+e \\pg). 
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Moreover, these Fisher informations satisfy the relation [262]: 



Je < Je < Jo- 

In the multi-parametric case, based on the the partial derivative for the fc-th 
parameter we can similarly define the logarithmic derivatives for the k- 
th parameter Lg-k,Lg-k, and Lg-k- Hence, the SLD Fisher information matrix 
-70;/c,z[265], the RLD Fisher information matrix Je ; fc 5 j[260], and the KMB Fisher 
information matrix Je.^[261] are defined as 

Jd;l,k '■= Tr pgLg. k O Lg-i, Jg-^k '■= Tr pgLg. k j) e .p Jg-l^k '■= Tr pgLg. k Lg.[. 

In the Gaussian case, i.e., {P(g 1+ ig 2 )/^/2jf\9 £ R 2 }, these matrices Jg = [Jg-k,i][265], 
Jfl — [<^0;fc,z][26O], and Jg = [Jg- t k,i\ are calculated as 





N+l/2 i/2 
) \ _,/ 2 7V+1/2 



J* 1 



N+l/2 i/2 
-i/2 N+l/2 



(337) 



Further, if the state family is parameterized by a complex number as p z , z G C, 
we often use the following Fisher information [266]. 

1 rp t yt T 

J z := Lrp z L z L z , — — = p z L z . 



dz 



In the Gaussian case [266], we have 



dpg 



,N 



09 N r 
Here, we use the formula 



* (at- 3)^, Je = =^j. 



(338) 



p e w(a j - 9) 



N 
N+l 



y - 9) P 



e.N- 



(339) 



7.2 Measurement theory 



In the quantum system, any measurement can be described by positive op- 
erator valued measure (POVM) M. If the set of the measuring data Q is 
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discrete- valued, the POVM M can be given by the set of positive semi-definite 
operators {M^j^j) satisfying 



M w = I ( or / M u daj 



where the identity operator is described by /. When the state of the system 
is given as the density p, the measurement data obeys the distribution 



P p m (uj) = TrM ul p. 

If any element M u is a projection, it is called a projection valued measure 
(PVM). 

In the single-mode bosonic system L 2 (IR), the number detection is described 
by the POVM {|^)(^|}^o- When the state is given as the coherent state \a), 
the data obeys the Poisson distribution |(ri|a)| 2 = e _ l Q l 2 ^L-IL. 

When the set Q of measuring data u> has continuous values, the POVM has the 
integral form M(dw). That is, for any integrable subset Bcfi, the operator 
J B M(du>) is positive semi-definite, and the total operator J Q M{dui) is equal 
to the identity operator /. In particular, if any partial integral J B M(du) is a 
projection, it is called a projetion valued measure (PVM). 

In the single mode bosonic system L 2 (IR), the measurement of the position 
operator Q is described by its spectral measure Eq(dq), and that of the mo- 
mentum operator P is by its spectral measure of Ep(dp). The simultaneous 
spectral measure of P and Q is impossible. However, when we focus on the 
two mode system L 2 (IR)® 2 = L 2 (IR 2 ), we can simultaneously measure the op- 
erators -^(-Pi + P2) an d (Qi — Q2) because they are commutative with each 
other. Using this property, we can jointly measure the operators P and Q as 
follows. Assume that we prepare the main target bosonic system L 2 (IR) with 
arbitrary state and the (additional) ancilla bosonic system L 2 (IR) with 

the state |0o)(0o|- When we perform the measurement corresponding to the 
simultaneous spectral measure of -^(Pi + P2) an d ^ (Qi — Q2), the data p 
and q obey the distribution 

Pip, q) = \(*l> ® ^o\^(Pi + P2) = P, ^={Qi ~ Q2) = q)\ 2 



Z7T J-00 

° e lV * pq "iP(q")Mq" ~ V2q)V2dq"\ 2 



1 

7T 



2?r 

(T \D(V2q,V2p)\ilj) 



00 

2 



where q" = Note that D(s,t) = e i( - sQ ^ = D{a) = e iaa+ia * a \ where 
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a = Therefore, if we regard this protocol as the measurement for the 
main target bosonic system L 2 (IR 2 ), it is described by the POVM 

-D(a)\ip )(ipo\D(a>ydqdp, 

7T 

where a = p+iq. When (^o IQ2 l^o) — (^ol-f^l^o) — 0, the average of p, q,p 2 , q 2 , 
and pq are calculated as 

pTr p-D(a)\^ )(f \D(a)Updq = Tr ±={P X + P 2 )(p ® |^o)(^o|) 



|- X 1 

/ qTx p-D(a)\i)Q){%l)o\D(a) ] dpdq = -^TrQip, 

JR" 2 7T a/2 



and 



2 



p 2 Tr p—D(a)\ifjo}{ipo\D(a>ydpdq = Tr ( + P 2 ) ) (p ® |^o)(^o|) 
! 7T \v2 / 

= ^((TrP 1 2 p) + (^o|P 2 >o)) 
g 2 Trp-D(«)|^)(^|P(a)t^g= i((Trg 2 p) + ^ |g 2 |^ )) 

! 7T Z 

gp'B:piD(a)|^)(^|£)(a)tdpd g = ^((TrQi o P lP ) + (^ |g 2 o P 2 |^ )), 
where Q\o P± :— QiEi±EiQx_ Hence, the covariance matrix is given by 

I I TrP 2 p TrQ l0 P lP \ \( (TrP lP ) 2 (Tr P lP )(Tr Q lP ) 
2 \TiQ l oP l p Trg 2 p J 2 1 (Tr P lP )(Tr g lP ) (Trg lP ) 2 



1 

+ 2 



(VoiPiiV'o) (^oig 2 op 2 |^o)) 
(^oig 2 op 2 ^o) (V'oigiiV'o) 



(340) 



That is, the accuracy of this measurement depends on the choice of the ancilla 
state ipo. For example, if we choose the vacuum state |0) as the ancilla state 

ipo, the last term equals |/ 2 . In this case, this measurement has the form 
^\a)(a\da, and is called the heterodyne measurement. If we perform this 
measurement to the system with the coherent state | ck) (a | , the data obeys 
the Gaussian distribution ^e~' a_ ^ . Hence, if the state of the system is Gaus- 
sian state p^]v = Ic \P)(P\ e ~~ N< ^ ne data obeys the Gaussian distribution 
i«-ci 2 

7r(i+lv) e 1+N ' ^ ^ e sc L ueeze d state |C, 0) is choosed as the ancilla state ipo, 
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the last term of (340) is equal to a real symmetric matrix S with determinant 
j. In addition, when p is the Gaussian state p^jf, the above matrix is equal to 

(N+±)I 2 + S. (341) 



Indeed, the heterodyne measurement ^|a)(a;|(ia; not only satisfies the condi- 
tion 

f a 

a= / -|a)(a|da, (342) 

JC 7T 

but also can be regarded as the measurement of the annihilation operator a 
because of the following reason. Assume that a POVM M(da>) satisfies the 
condition 




Then, we obtain 

aa ] > f M(da) (343) 
Jc 

because 

aa) — / \a\ 2 M(da)= \ (a — a)M(da)(a — otfda > 0. 

We can easily check that the heterodyne measurement -\a)(a\da satisfies the 
equality of the above inequality. Using this inequality, we can evaluate the 
variance V P (M) of the measuring date in the following way when the state is 
given as the density p 

Vp(M) = Tr p / |a| 2 |a)(a|(ia — | Tr pa\ 2 < Tr pact) — \ Tr pa\ 2 . 
Jc 

Hence, if the equality of (343) holds, the measurement can be regarded as the 
optimal measurement for the annihilation operator a. Since the heterodyne 
measurement -\a)(a\da satisfies its equality, it can be regarded as the optimal 
measurement of a. 

Moreover, the annihilation operator has the form a = \% , hence, the het- 
erodyne measurement can be treated as the optimal joint measurement of the 
operators Q and P. 

In particular, when the state p is a Gaussian state p^ ^, we obtain 

V p (-\a)(a\da) = N + 1. (344) 
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Indeed, as is discussed latter, this POVM is used for the estimation of the 
unknown parameter of the Gaussian state. 

In order to realize this measurement, we need to treat quantum correlation be- 
tween two bosonic systems. However, the required correlation can be perfumed 
only by the beam splitter (Sec 1.5). 

7. 3 Formulation of estimation 

In the quantum theory, in order to obtain any information from the system 
of interest, we need to perform a measurement to the system. Needless to 
say, the measurement always causes the demolition of the state of the system. 
Hence, the choice of the measurement is crucial. In this section, in the case 
of Gaussian state, we optimize the measurement for the estimation of the 
prepared unknown state. 

In the estimation theory, we usually assume that the true density p belongs 
to a given state family S = {pe\9 e 0}, where is the parameter space. For 
simplicity of our analysis, we often assume that the set is finite-dimensional. 
In this case, the estimator is given by a POVM M(d8) taking the measuring 
data in the parameter space 0, i.e., the POVM is continuous-valued. Hence, 
when we use the estimator M and the true parameter is 9, the estimated 
value 9 obeys the distribution Tr M(d9)pg. In order to treat the accuracy of 
our estimation, we focus on the risk function W{9, 9), which describes the 
degree of the miss-estimation when the true parameter is 9 and our estimated 
parameter is 9. Thus, the accuracy of the estimator M is evaluated by the 
mean risk: 

Vf{M):= ( W(9,9)TrM(d9)p . (345) 
Je 

In the statistics, when the parameter space is a subset of R, we often adopt 
the square error (9 — 9) 2 as the risk function W(9, 9). In this case, the mean 
risk: 

MSE g (M) := J (9 -9) 2 Trp e M(d9) (346) 

is called the the mean square error (MSE). When the parameter space is 
C, i.e., the family has the form {p z \z G C}, the MSE is given by 

MSE Z (M) := J \z-z\ 2 Trp z M(dz). (347) 

In the multipara-metric case, we often adopt Y,k=i(@ k ~ @ k ) 2 as the risk function 
W{9,9). In the quantum theory, we often use 1 — F 2 (p e ,pg) or the square 
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of Bures' distance dl(pe,p^) as the risk function. Usually, we assume that 
W(9, 9) > and the equality holds if and only if 9 = 9. 

7.4 Independent and identical condition 

In the statistics, we often assume that the data are independent, identically 
distributed (i.i.d.) with the unknown probability distribution GO- Based on this 
assumption, we can easily treat estimation theory in the case where the number 
n of data is large, i.e., in the large sample case. This is because asymptotic 
expansions are available in the large sample case. 

In the quantum case, when each system is prepared in the same state p, the 
state of the n-fold system 7-t® n is given by the n-fold tensor product state p® n . 
This setting is called the (quantum) n-i.i.d. case One may call the state p® n 
n copies of p. 

In the Gaussian case, the n-fold tensor product state p®^ is unitarily equiv- 
alent with p jy <g> pfjj- In order to construct the above unitary U, we gen- 
eralized the discussion for beam-splitter, for any n x n special unitary matrix 
Mb, there exists a unitary operator Ub on L 2 (IR n ) such that 

U B {a\,...,ai)U B = (al,...,4)M B . 

If the special unitary matrix Mg has the form 

\~h * ••• */ 

the unitary operator U b satisfies 

UBP^U B = p^®p^. 

Since the state p®^ has no information concerning the (, the estimation 
problem with n copies can be resulted in the estimation with the family 

WhcaK g C}. 

3 Currently, many mathematical statisticians treat dependent data, and they ob- 
tained several basic results similar to the i.i.d. case. However, the discussion of the 
dependent case is so difficult that we mainly focus on the i.i.d. case in this paper. 



M, 



B 
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In the following, we prove the optimality of the heterodyne measurement 
-\a)(a\da for the Gaussian family {p^jj\( G C}. in the respective formu- 
lations. 



7.5 Bayesian method 

The minimum value of the mean risk T>Y{M) is when the estimated param- 
eter is always 9, however, it is impossible to minimize the mean risk T>Y(M) 
simultanouesly to all 9. Hence, we have to trade-off T>q(M) with all elements 
9 in 

the parameter space 0. As one method for this trade-off, Bayesian method is 
known. In this approach, we assume that the known parameter 9 is generated 
the prior distribution p on the parameter space, and minimize the average of 
the mean risk 



V™{M)p{d9). 

e 



In the one-parameter case {pe\9 6 C M.}, the Bayes estimator (the optimal 
estimator of Bayesian approach) concerning the MSE is given as follows [267]. 

f [ (9- 9f Tr Pe M(d9)p(d9) = Tr / (p6 2 - (Lp + pL)9 + S) M(d9) 

JR JR JR V ' 

= Tr [ (L — 9)p(L - 9)M(d9) + S - LpL, 

JR 

where the operator p, L, and S are defined by 

p := / PB fi(d9), S := / 9 2 p e p(d9) J (Lp + pL) = 2 [ 9p e p(d9). 

Jr. Jr Jr 

The equality of the inequality 

Tr / (L - 9)p(L - 9)M(d9) > 
Jr 

holds if and only if the POVM M is equal to the spectral measure of the 
operator L. Hence the optimal estimator is given as the spectral measure of 
the operator L, and its optimal error is equals Tr S — LpL. 

If we apply the same method to the two-parameter case, we have to consider 
a simultaneous spectral measure of two operators, which correspond to the 
respective parameter. Since such a simultaneous spectral measure is impossible 
generally, this problem of the two-parameter case is more difficult. However, 
its Gaussian case can be solved when the prior is the Gaussian distribution. 
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In this case, the Bayes estimator concerning the MSE can be obtained by the 
following calculation: 



TlNi Jc 

Tr _ 1 _ 

tt^N + N^Jc 



\6 -6\ 2 Trp e M(d6)e »i d9 

2 



iVi 



Nx + N 
Ni 



\a)(a\e N i+ N daM(d9) + JVi - — — 



Po,N!+N a 



W^W) ^,N 1+ N^)M(d9) + =-^= 



Trf _ N ± J -9* 



iVi + iV 



iVx + iV (JVi + iV+ l)(iVi + AT)' 

where the second equation follows from (339) and the final equation follows 
the next equation: 



V^ttI (N 1 + N)-(= 



Ni + N + 1 



Q Po,iVi+7V a 



iVi + 7V 



Ni + N + 1 



(iVi + iv + i; 



(JVi + JV + l)(Wi + iV) 
The equality of the inequality 

Ni 



Tr = 

ViVi + iv + i 

holds if and only if 



V — 9* } O n AT. I AT 



iVi 



M(d9) 



N 1 + N+lA I N x + N +1 



_ 9 



#1 



_ 

iVi 



d0. 



Hence, the minimum error is equal to — + _ — + — , and the optimal 

estimator is given by the above POVM, which is realized by the heterodyne 
measurement. This value is smaller than the error of the usual heterodyne 
measurement with the following value. 



N N X (2N +l) + N +N 

Ni + N + (N 1 + N +1)(N 1 + N)' 
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This difference goes to when Ni goes to infinity. 



7.6 Group covariant method 

However, we cannot use the Bayesian method when our prior knowledge is in- 
sufficient to decide the prior distribution. Hence, several non-Bayesian meth- 
ods, e.g., the minimax method and minimum variance unbiased estimation 
have been proposed. 

In the minimax method, we focus on the worst error for an estimator: 

maxZ>F(M), 

eee 

and optimize it. This method provides an attractive estimator when the family 
of probability distribution has a homogenous structure. In the Gaussian case, 
the state family {p^]y|C £ C} has the following group symmetry: 

Hence, if that risk function W(9, 9) is invariant for the action U, i. e., W(9, 9) = 
W{6 + 7], 9 + r]), the relation 

minmaxP^(M) = min VY(M) (348) 

M 06© Mxovariant 

holds, where the POVM M on C is called covariant if 

V{r))M{9)V{rj) ] d9 = M(9 + rj)S, 
which is equivalent with the following form 

M{9) = -V(9) ] P Q V(9)d9. 

71 

The relation (348) is called Quantum Hunt-Stein's lemma. (It was obtained by 
Holevo [268] when G is a compact group, and by Ozawa [269] and Bogomolov[270] 
when G is a non-compact group.) 

In the Gaussian states family {p^jylC e C}, if the risk function W(C> C) can 
be written by a monotone increasing function of |C~CI) the optimal estimator 
is given by the heterodyne measurement: That is, the optimal esti- 

mator does not depend on the form of the risk function, and depends only on 
the group invariance. This optimality can be proven by treating the following 
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case: 

f l IC-CI > R 
[o K-CI <R. 

In fact, this optimality has been shown by Cerf et al. [271] only when W is 1— 
fidelity and N = 0. 

In the above general case, using the operator W := ^ I\o>r U(()p jjU((yd(, 
we can describe the error T)^(M) as T>W(M) = Tr WPq. Hence, it is sufficient 
to show (0|VF|0) < (fc|W"|A;) for any integer k. For this proof, we focus on the 
equation 

r ( 1 l r ic-^i 2 \ , l2 \ a \ 2k 

(k\W\k)= / = / e~^dC, e~ H ^—da. 

S 1 17 7c \it ttN J\c\>R J k 

Since i|d>-R e ^~^C^j an d ^ir~ are mon °tone increasing function con- 

cerning \a\, the probability distribution e~' Q ' 2 <ia satisfies 

< f ( I-L / e'^c/cl e- |Q|2 ^rfa = (jfelT^lifc). 
~7c VvrvriV7|c|>fl 7 jfe N ' ' ' 

Therefore, we obtain the optimality of the heterodyne measurement in the 
group covariant model. 



7. 7 Unbiased method 



Finally, we consider minimum error under the unbiased estimators. In the 
statistics, we often restrict our estimators to the unbiased estimator, i.e., we 
assume that the estimator M of the family {pe\6 G M.} satisfies 

E fl (M) := f 6p e M(d6) =6, V# G 0. (349) 

And we minimize the mean square error (346) among unbiased estimators. If 
the estimator M satisfies the unbiasedness condition, the MSE is bounded by 
the inverse of the SLD Fisher information Jg (336) as 

MSE e (M) > (Je)' 1 . (350) 
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This inequality is called SLD Cramer- Rao inequality [259]. It can be shown 
by the Schwarz inequality as follows. Taking the derivative in (349), we have 

Tr((0(M) - 9) o L e )p = Tr(0(M) - 9){L e o p) = Tr(0(M) -0)^ = 1, 

da 

where O(M) = J 6M(d6). the Schwarz inequality implies that 

Tr(0(M) - Ofp ■ J e = Tr( (O(M) - 9) o (O(M) - 9))p 6 ■ Tr(L e o L e )p e 
>\Ti((0(M)-9)oL e )p e \ 2 = 1. 

Since 

j{9- Of Tr pM{d9) - Tr(0(M) - 9) 2 p 
= Trp J[{9-9)-(0{M)-9)]M{d9)[{9-9)-{0{M)-9)\ > 0, (351) 

we obtain inequality (350). 

If the parameter z is a complex number, we obtain another type of Crameer- 
Rao inequality [266]: 

MSE e (M) > (Jo)- 1 . (352) 

It can be shown similarly. The operator O(M) = J zM(dz) satisfies the 
Schwarz inequality: 

Tv(P(M) - z)\0{M) - z) Pz ■ J z = Tr p z (0(M) - z)\0{M) - z) ■ Tr p z L z L\ 
>\Tt Pz L z (0(M)-z)\ 2 = 1. 

Hence, using a inequality similar to (351), we obtain inequality (352). 

If we focus on the weighted MSE Wi(Ci - Ci) 2 + W 2 & ~ C2) 2 , the RLD 
Fisher information matrix is very useful. In this case, we focus on the Co- 
variance matrix: Cov(M) := (Y c (0 — Ci) (Ci — Ci) Trp^M(rf^)^, and minimize 
Tr G Cov(M) among unbiased estimators M, where G is a symmetric real ma- 
trix. Applying a discussion similar to RLD Fisher information, we can show 
[260] 

Cov(M) > J"!. (353) 
Since the matrix Cov(M) is real symmetric, any unbiased estimator M satisfies [260] 



TrGCov(Af)> min {TrGV\V > J7^} (354) 

V: real symmetric matrix 

= (N+ ^)TrG + VdetG. 
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In the last equation, we use equation (337). This value can be attained by S = 
^pG" 1 in (341) (V = (N + \)h + ^pG" 1 in (354)). That is, the optimal 
measurement can be realized by replacing the coherent state in the ancilla by 
the squeezed state. This discussion can be applied to the asymptotic theory 
of the state estimation in the quantum two-level system because the states in 
this system can be approximated by the Gaussian states in the asymptotic 
sense [272]. 

Now, we apply this inequality to Gaussian states family {p^jylC £ C}. Then, 
from (338), the minimum MSE among unbiased estimators is N + 1. From 
(342), the heterodyne measurement Jc^KXCMC is an unbiased estimator. 
From (344), this value is attained by the heterodyne measurement. That is, 
the heterodyne measurement is the optimal estimator even among unbiased 
estimators. Note that this discussion can be applied even in the pure states 
case. 

Next, we consider the estimation of another parameter N. Assume that ( = 
0. Then, the SLD L w is equal to E£°= (f ~ \n)(n\. Therefore, J w = 
■ The MSE of unbiased estimators is N(N + 1). This bound is attained 
by the number counting {|n)(n|}^ . However, if we use the heterodyne mea- 
surement, the MSE is (N + l) 2 , i.e., this bound cannot be attained. 

The advantage of this approach is that n-copy case can be treated just parallel 
to one-copy case. That is, we can easily construct unbiased estimator for the 
n-copy family from an unbiased estimator for the one-copy family. In this 
case, the bound (J#) _1 becomes the - times of the one of the one-copy case. 
Further, the MSE also behaves similarly. Therefore, in the n-copy case of 
the Gaussian states, the bound of MSE concerning £ is ±¥±1 : and the bound 
of MSE concerning N is N ( N+1 *> . For this simultaneous estimation, we first 
perform the state evolution as p®^ — > p <8> Pq^- Next, we perform the 
heterodyne measurement for the first state jf, and we perform the number 
counting for the remaining states p®^. In this case, the MSE concerning £ is 

^±1 and the MSE concerning N is M^±ii_ That is, this method is almost 

n ' ° n— 1 ' 

optimal even for the estimation of N. 

Hence, we can conclude that this measurement realize the simultaneous opti- 
mal estimation between the two parameters ( and AT [2 73]. 



7.8 Simple hypothesis testing 



Next, we treat the statistical simple hypothesis testing. In this problem, it 
is known that the unknown state is the null hypothesis po or the alternative 
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hypothesis p±. It is required to reject the null hypothesis po with a fixed error 
probability, and accept the alternative hypothesis p\. This problem is the sim- 
plest case of statistical hypothesis testing, and its mathematical formulation 
is well established even in the quantum case. 

In this case, if the null hypothesis is rejected despite being correct, it is called 
the error of the first kind. Conversely, if the null hypothesis is accepted despite 
being incorrect, it is called the error of the second kind. Then, we make our 
decision only when we support the alternative hypothesis, and withhold our 
decision when we support the null one. Now, we describe our decision by the 
two-valued POVM {T, / — T}, where the outcome of T supports pQ. This pos- 
itive semi-definite operator T is called a test. Then, the first error probability 
is equal to Tr p (I — T), and the second error probability is equal to Tr p{T. In 
this problem, it is required to keep the first error probability Tr po(J — T) less 
the fixed error probability. We minimize the second error probability Tr p{T 
under the above condition for the first error probability Tr po(J — T). That is, 
we often focus on the following value: 

&Oo||pi) := ™n o {Tr Pl T\Tr p (I - T) < e}. 

When we prepare the n copies of the unknown state, we treat /3"(pf "IIP?")- 
If the error threshold e is fixed, this value goes to exponentially. Hence, we 
focus on its exponential rate. In fact, the exponential rate is given as 

hm — log &"(pH =D(p \\ Pl ), 1 >Ve>0, 
n 

which is called quantum Stein's lemma [2 74, 2 75]. In the Gaussian case po = 
p£ jv and p\ = p^ jj, this bound is equal to |£o — Ci| 2 log (335). 

Indeed, when pi is not commutative with po, we need quantum correlation in 
the measuring apparatus for realizing the test T attaining the optimal bound 
D (poll Pi)- That is, if we perform any separable measurement, the bound can- 
not be attained [276]. In the above Gaussian case, the following test attains the 
bound. First, we perform the state evolution as p®^ — * p ^(n^Pqjj • Next, 

we perform the state evolution as p^ Ci iv ® P^? -> P^((-d),N ® Poj? ' 
Then, we perform the number counting for the first system. Finally, the de- 
tected number n is greater than the threshold, we support p^ ^. Otherwise, 
we support p^jy- For the threshold, see Hayashi [276]. In this test T n , the first 
error Tr p® n 7 r f (J — T n ) goes to and the second error Tr p® n -^T n goes to with 

the exponential rate |£ — Ci| 2 l°g ^w^[276]. This fact indicates the importance 
of the quantum correlation using the beam splitter. 
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version. (We use the page number and equation number of the published ver- 
sion in Physics Reports.) 

1) After Eq.(15), we consider the n mode Gaussian states. In some places n 
had been wrongly typed by m. 

2) Page 8, line 7 and line 11, S e SP(2n,R) is replaced by M G SP(2n,R); 
line 12, SAS T is replaced by MAM T . 

3) The RHS of Eq.(86), the position of matrix and vector should be reversed. 
See ther right form in Eq.(86) of this version. 

4) Eq.(245) is replaced by = (1 + r a )s a (n'), as used in this version. 

5) The text after Eq.(246) and before the paragraph prior to Eq.(248) is rewrit- 
ten. 

6) Eq.(250) is modified, as Eq.(250) in this version. 
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Abstract 

Quantum optical Gaussian states are a type of important robust quantum states 
which are manipulatable by the existing technologies. So far, most of the impor- 
tant quantum information experiments are done with such states, including bright 
Gaussian light and weak Gaussian light. Extending the existing results of quantum 
information with discrete quantum states to the case of continuous variable quan- 
tum states is an interesting theoretical job. The quantum Gaussian states play a 
central role in such a case. We review the properties and applications of Gaussian 
states in quantum information with emphasis on the fundamental concepts, the 
<^ ■ calculation techniques and the effects of imperfections of the real-life experimental 

setups. Topics here include the elementary properties of Gaussian states and relevant 
quantum information device, entanglement-based quantum tasks such as quantum 
teleportation, quantum cryptography with weak and strong Gaussian states and 
^ . the quantum channel capacity, mathematical theory of quantum entanglement and 

H ' state estimation for Gaussian states. 

Contents 

1 Introduction [3 

1.1 Elements of quantum information with 2- level states 

1.2 Phase space representation and definition of Gaussian states 

1.3 Coherent states LLa 



1 Email: xbwang@mail.tsinghua.edu.cn 

2 Email: tohya@qci.jst.go.jp 



Preprint submitted to Elsevier Science 



3 February 2008 



1.4 Squeezed states 

1.5 Beam-splitter 

1.6 Beam-splitter as an entangler 

2 Entanglement-based quantum tasks 

2.1 Teleportation with two-level states 

2.2 CVQT with Gaussian states 

2.3 Experiment 

2.4 Dense coding with two-mode squeezed states 

2.5 Quantum error correction codes 

2.6 Gaussian cloning transformation 

2.7 Entanglement-based quantum tasks with weak Gaussian states: 
post-selection vs non-post-selection 

3 Quantum cryptography with weak coherent light 

3.1 Introduction 

3.2 QKD in practice 

3.3 Eavesdropping and security 

3.4 Ideas of unconditional security proof 

4 Security proofs and protocols of QKD with weak and strong 
Gaussian states 

4.1 Entanglement purification and security proof of QKD 

4.2 Secure key distillation with a known fraction of tagged bits 

4.3 Decoy-state method 

4.4 SARG04 protocol 

4.5 QKD in position-momentum space 

4.6 Security proof of QKD with squeezed states 

5 Mathematical theory of quantum entanglement with Gaussian states 



5.1 General Properties of Quantum Entanglement IllC 

5.2 Entanglement Properties of Gaussian States 1 112 

5.3 Conclusions 1 127 

6 Classical capacities of Gaussian channels Il28 

6.1 Classical Capacities of Quantum Channels 1 128 

6.2 Gaussian Channels 1 13C 

6.3 Gaussian Channels with Gaussian Inputs 1 136 

6.4 Dense Coding with Gaussian Entanglement |14C 

6.5 Entanglement measure 1 142 

7 Estimation theory for Gaussian states 1 142 

7.1 Information quantities 1 143 

7.2 Measurement theory Il45 

7.3 Formulation of estimation ll4S 

7.4 Independent and identical condition |15C 

7.5 Bayesian method 1 15 1 

7.6 Group covariant method 1 153 

7.7 Unbiased method Il54 

7.8 Simple hypothesis testing 1 156 

8 Acknowledgement 1 158 
References 158 



1 Introduction 



Quantum information processing (QIP) is a subject on information processing 
with quantum states[l]. In the recent years, the subject has attracted much 
attention of scientists from various areas. It has been found that in some impor- 
tant cases, quantum information processing can have great advantage to any 
known method in classical information processing. A quantum computer can 



3 



factorize a large number exponentially more efficiently than the existing clas- 
sical methods do [2]. This means, given a quantum computer, the widely used 
RSA system in classical communication is insecure because one can factorize a 
huge number very effectively by Shor's alhorithm. Interestingly, quantum key 
distribution (QKD) can help two remote parties share a random binary string 
which is in principle unknown to any third party [3]. Private communication 
based on QKD is proven secure under whatever eavesdropping including quan- 
tum computing. Quantum teleportation can transfer unknown quantum state 
to a remote party without moving the physical system itself [4]. 

In classical information processing, all information are carried by classical bits, 
which are binary digits of either or 1. The physical carrier of a classical bit 
can be any physical quantity that has two different values, e.g., the electri- 
cal potential (positive or negative voltages). These are macroscopic quantities 
which can be manipulated robustly by our existing technology. In quantum 
information processing, we use quantum states to carry either quantum infor- 
mation or classical information. Also, we use quantum entangled states as the 
resource to assist the effective processing of quantum information. In princi- 
ple, lots of different physical systems can be used to generate the requested 
quantum states and quantum entanglement. In those tasks related to com- 
munication, light seems to be the best candidate for the physical system to 
carry the quantum information and/or the quantum entanglement due to its 
obvious advantage that it can be transmitted over a long distance efficiently 
Therefore one may naturally consider to use a single-photon state as a quan- 
tum bit (qubit) and a two-photon entangled state as the entanglement resource 
to assist the processing. 

Towards the final goal of real-life application of quantum information process- 
ing, a very important question in concern is how robustly we can manipulate 
the quantum states involved. In practice, preparing the single-photon states or 
two-photon entangled states deterministically are technically difficult. What 
can be prepared and manipulated easily is a Gaussian state, e.g., a coherent 
state [5,6] (the state of light pulses from a traditional Laser) or a squeezed vac- 
uum state[6,7,8,9,10,ll] of one mode or two modes. Mathematically, a state 
is Gaussian if its distribution function in phase space or its density operator 
in Fock space is in the Gaussian form. (We shall go into details of the phase 
space and Fock space later in this chapter and also other chapters.) Gaussian 
states have proven to be a type of important robust states which have been 
extensively applied for various QIP tasks in labs. Actually, so far almost all 
those important experiments of quantum information are done with Gaussian 
light. 

There are two types of application of Gaussian states in practical QIP. One 
is to use weak Gaussian light as approximate qubits or two-photon entangled 
states. The other is to use strong Gaussian light for continuous variable QIP. In 
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applying the weak Gaussian light, one can regard weak coherent light [5] as ap- 
proximate single-photon source and regard 2-mode entangled weak Gaussian 
light as probabilistic 2-photon entanglement resource in polarization space. 
Weak Gaussian states have been used in many experiments such as the quan- 
tum teleportation with spontaneous parametric down conversion (SPDC)[12] 
and quantum cryptography with weak coherent states or SPDC[13]. How- 
ever, sometimes the higher order terms, i.e., the multi-photon states in the 
single-mode Gaussian light or the multi-pair states in the two-mode Gaussian 
light take a very important role even though the Gaussian light in applica- 
tion is weak. For example, in QKD with weak coherent states, the final key 
can actually be totally insecure if we ignore the role of multi-photon pulses. 
For another example, in quantum-entanglement based experiments such as 
quantum teleportation with SPDC, it is possible that actually there is no en- 
tanglement and the result is a post-selection result if we don't consider the 
detailed properties of the weak Gaussian states. We shall review these types of 
effects and possible ways to overcome the drawbacks. One can also use strong 
Gaussian light to obtain the analog QIP results of discrete states for contin- 
uous variable states. One important advantage here is that strong Gaussian 
light can be used as a resource of deterministic quantum entanglement there- 
fore the results are deterministic and non-post-selection. This is quite different 
from QIP using weak Gaussian states where the results are often probabilistic 
and post- select ion. We shall review the main theoretical results of continu- 
ous variable QIP with strong Gaussian light including quantum teleportation, 
cloning, error correction and QKD using a strong Gaussing light. We shall also 
review the quantum entanglement properties of multi-mode Gaussian states, 
quantum channel capacity and quantum state estimation of Gaussian states. 

This review is arranged as follows: In the remaining part of this section, we 
present the elements of QIP and Gaussian states, including an overview of 
quantum information with qubits and two-photon maximal entangled states, 
mathematic foundation and definition of Gaussian states and properties of 
a beam-splitter as an elementary QIP device. In section 2, we review the 
entanglement-based quantum tasks with Gaussian states, which seem to be a 
very hot topic in the recent years. The section includes quantum teleportation, 
quantum error correction, quantum cloning and non-post-selection quantum 
tasks with weak Gaussian states. We then go into the most important appli- 
cation of QIP, practical quantum key distribution in section 3 and section 4. 
Section 3 introduces the elements and technology background of QKD with 
weak coherent light, section 4 reviews the protocols and security proofs of 
QKD with weak and strong Gaussian light. We then change our direction 
to the mathematical theory of QIP with Gaussian states in section 5 and 6. 
Section 5 is on quantum entanglement of Gaussian states, which have been 
extensively studied these years. Section 6 is on the properties of quantum 
Gaussian channel, which is assumed to be a fundamental subject in quantum 
communication. The theory of quantum state estimation of Gaussian states is 
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reviewed in section 7. This review does not include quantum computation. 



1.1 Elements of quantum information with 2-level states 



A qubit is simply a physical system that carries a two-level quantum state. 
For example, a photon can be regarded as a qubit in polarization space or any 
other two dimensional space. In general, we have the following mathematical 
form for the state of a qubit 

\^) = a\0) + [3\l) (1) 

and \a\ 2 + \/3\ 2 = 1. Here |0) and |1) are orthonormal states of any two-level 
system. Mathematically, one can use the following representation 



|o> = W ;|1>= UJ" (2) 

Consequently, we can use matrices as representations of operations to a qubit. 
In particular, the unity matrix / represents for doing nothing, matrix o~ x = 



1 (10 

for a bit-flip operation, a z = \ \ for a phase-flip operation and 

10 I -1 



i 
-i 



for both bit-flip and phase-flip. 



If we use the photon polarization, notations |0), |1) represent the horizontal 
polarization and the vertical polarization (polarization of angle vr/2) respec- 
tively. One can replace them with more vivid notations of \H), \ V). For exam- 
ple, state cos 6\H) + sin^y) is the state of polarization angle 6. In the above 
equation, \ip) is linearly superposed by |0) and |1). The quantum linear su- 
perposition is different from the classical probabilistic mixture. For example, 
consider the polarizations of 7r/4 and 37r/4. They are the linear superposition 
states of |±) = -^(\H) ± |V)). Given state |+), i.e., polarization of 7r/4, if 
we measure it in the \H), \ V) basis, we have equal probability to obtain an 
outcome of either \H) or \V). This is due to the fact 

l<tf|+>| 2 = l(^l+>| 2 = l/2. (3) 

However, the state |+), i.e., the polarization of n/4 is different from a mixed 
state which is in a classical mixture of horizontal and vertical polarizations, 
with equal probability. Such a classical mixture can be realized in this way: 
Source A only emits photons of horizontal polarization and source B only 
emits photons of vertical polarization. In a remote place we receive photons 
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from both sources. But we don't know which photon is from which source. Our 
only knowledge is that any photon has equal probability from A or B. In such 
a case, any individual photon is in a classical mixture of state \H) and \ V). If 
we measure such a mixed state in {\H), \V)} basis, the measurement outcome 
is identical to that of a pure state of tt/4 polarization. However, if we use a 7r/4 
polarizer, the outcome will be different: the pure state of ir/4 polarization will 
always transmit the polarizer while the mixed state only has half a probability 
to transmit the polarizer. These can be interpreted mathematically by Eq.(3) 
and the following equation : 

l(+l+)| 2 = l- (4) 

Eq.(3) shows that both \H) and \V) have half a probability to transmit the 
it/ 4— polarizer. This means, any classical mixture of \H) and \V) will always 
only have half a probability to pass through the 7r/4— polarizers. To have a 
universal mathematical picture for both pure states and mixed states, we can 
use density operator which reflects the classical probability distribution over 
different quantum states. Suppose a certain source consists of n sub-sources. 
Any sub-source i will only produce the pure state j^). Whenever the source 
emits a photon, the probability that the photon being emitted from sub-source 
% is Pi (pi + P2 + • • -Pn — !)• The state of any photon from such a source can 
be described by the density operator X^Pil^iX^I- A density operator can be 
represented by a matrix which is called as density matrix. The density matrix 
for pure state — a\0) + /3\1) is 





mi>\ = i i («*,/?*)= i 1 1 „ i ■ (5) 

Given any pure state \ip), there is always a unitary matrix U satisfying 

w = m- (6) 

This is to say, we can use the following criterion for a pure state = 
E/|0)(0|£/T: Given a density matrix M, if it is for a pure state, there exists a 
unitary matrix U so that 

UMU ] = | L V I . (7) 




Besides qubits, quantum entanglement is often needed in non-trivial QIP 
tasks, such as quantum teleportation[4]. We shall consider the most well- 
known case of two-photon maximally entangled state in the polarization space. 
Consider the state for spatially separated two photons, A and B. We have 4 
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orthogonal states to span the polarization space of the two-photon system: 



l^> = ^=(\H)a\H) b ± \V) A \V) B ); |^> = ±={\H)a\V) b ± \V) A \H) B ). 

All these 4 states are maximally entangled and we shall call any of them as 
an EPR (pair) state named after Eistein-Podolsky-Rosen[14], or a Bell state. 
We shall also call the measurement basis of these 4 EPR states Bell basis. 
We use \<j) + ) to demonstrate the non-trivial properties of an EPR pair. For 
the pair state \<f) + ), the polarization of photon A and photon B are corre- 
lated: if we measure each of them in {\H), \ V)} basis, we always obtain the 
same polarization outcome for two photons. However, this alone does not 
show any non-trivial property of quantum entanglement. Because a certain 
classical correlation can also produce the same result. Consider a mixed state 
p c = l[(\H)(H\) A ®(\H)(H\) B +(\V)(V\)A®(\V)(V\) B }.This state also always 
produces the same polarization for two photons, if each photon is measured 
in {\H), \ V)} basis. One can easily imagine a physical realization of such a 
state: a source always produces two horizontally polarized photons flying in 
different directions (photon pairs). However, whenever there is an emission, 
with half probability we do nothing to the two photons and with half proba- 
bility we rotate both of them by tt/2. In a remote place, it is unknown which 
pair is rotated which pair is not. Then any pair is just in a state with clas- 
sical correlation as stated above. However, an EPR pair has something more 
than this. Given state if each photon is measured in {|±)} basis, we 

shall still always find the same polarization correlation for two photons in the 
measurement outcome: either both of them are |+) or both of them are | — ), 
for 

I0 + ) = ^(I+)a|+)b + |-)a|-M. (8) 

However, given the state with classical correlation, p c , there is no correlation 
between two photons if we measure each of them in {|±)} basis. As one may 
easily check it mathematically: 

(+ + \p c \ ++) = ("- \Pc\ "-) = (+- \Pc\ + ") = (- + \pc\ -+) = 1/4. (9) 

Here we have omitted the subscripts for photon A and B. 

In the entanglement-assisted QIP tasks, we often need a Bell measurement, 
i.e., a collective measurement in the basis of 4 EPR states. As shall be shown, 
the Bell measurement to a photon pair can be partially done by the currently 
existing technology through a beam-splitter. 

We often need two elementary ingredients in QIP with two-level states: a qubit 
state and an EPR state. Give these resources, we can carry out a number of 
non-trivial tasks. As noted earlier, in practice, a perfect single photon source 
for qubits and a perfect entangled-pair source are difficult techniques. Actually, 
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in almost all existing QIP experiments, these difficult sources are replaced by 
weak or strong Gaussian states. The goal of this review is to present the main 
results of QIP with weak and strong Gaussian states. 



1.2 Phase space representation and definition of Gaussian states 



To clearly define the Gaussian states, we shall use the phase space[15, 16, 17,18]. 
We first take a look at some elementary properties of the Fock space[15, 16, 17,18] 
Consider the single-mode field. We have photon-number operator, N. Any 
Fock state |/) is an eigen-state of photon-number operator, i.e., N\l) = l\l). 
When we say that a light pulse is in state |Z), we mean there are I photons 
in that pulse. Also, we have creation operator a) and annihilation operator a 
and N = a^a, i.e. 

a)a\l) = l\l). (10) 
Moreover, a\a satisfy the following equations, 



a)\i) = VTTi\i + i) (11; 



and 



a\l) = Vl\l - 1). (12) 
with a\0) = 0. The operator a) and a don't commute and 

[a, a'] = aa) — a) a = 1. (13) 

A detailed derivation of the mathematical structure of this Fock space from 
classical electrodynamics can be found in, e.g. [15, 16, 17,18]. With eq.(ll), it's 
easy to see that mathematically any photon number state \l) can be generated 
from the vacuum by 

10 = ^|0). (14) 
Moreover, an arbitrary pure state in Fock space can be written in the form 

lx) = /(« t )|0), (15) 

where f(o)) is a functional of a) . For example, for state :~/g(|0) + |1) + |2)), we 
just set f(at) = 775(1 + oJ + 7^) to rewrite it in the form of eq.(15). 

Straightforwardly, one can extend the above one-mode Fock space to the multi- 
mode Fock space. Radiation field can be decomposed into different radiation 
modes characterized by the wave number vector and polarization [15, 16, 17,18]. 
Let Xk and pk denote the 'position' and 'momentum' operators associated with 
the kth mode, respectively (k = 1,2, ■•• , n). These operators or canonical 
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variables are written in terms of the creation and annihilation operators of 
the mode; 



and 



- (a* + 4) 



2u k 




Pk = y (a* -4) > 

where u>fc denotes the energy of quanta of the fcth mode (h — 1). Since [aj, a k ] = 
[aj, 4] = and [a,j, 4] = <5jfc) we have [xj, Xk] = \pj,Pk] — and [xj,pk\ = iSj^. 

Defining R = (R 1 R 2 ,---,R 2n ) T = (^l /2 Xi, ^ 1/2 pi, • • • , ^l /2 x ni uJ~ 1/2 p n ) T , 
these canonical commutation relations (CCRs) can be written compactly as 
[Rj,Rk] = iJjk- Here, J = ©™ =1 Ji with 



For convenience, we shall assume Uk = 1 unless specifically noticed. Most 
generally, the density operator of a state in Fock space can be written in a 
functional form of creation and annihilation operators. But we don't have to 
always use this operator format because a density operator can be represented 
by a (quasi) distribution function in phase space. The phase space representa- 
tion can often simplify the calculations. Actually, the so called Gaussian state 
can be easily defined as a state whose distribution function in phase space is 
in the Gaussian form. 

An n— mode density operator p is defined on the phase space that is a 2n- 

dimensional real vector space. The characteristic function is[15, 16, 17,18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 

X (0 = Tr[pW(0]- (16) 

Here, = exp(^ T i?) is called Weyl operator [15,16,19,20,21,22,23,24,25,26,27,28]. 

The density operator of any quantum state in Fock space can always be written 
in terms of its characteristic function and Weyl operators as follows 



(2k) 

A Gaussian state is defined as such a state that its characteristic 
function is Gaussian: 



X(0 = exp 



(17) 



Here, 7 > is a real symmetric matrix and g e M? n . As shown below, the 
quantum vacuum state, coherent states, squeezed states, and thermal states 
are typical Gaussian states and they constitute an important class of states in 
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quantum optics. In the picture of distribution function, an n-mode Gaussian 
state is characterized by the 2n-dimensional covariance matrix 7 and the 
2n-dimensional displacement vector d. On the grounds of those, much work 
has been reported on Gaussian states, in particular, in quantum information 
theory/experiment. 

The first moment is just the displacement given by dj = Tr(pRj) and the 
second moment is given by 

j jk = 2Tr[p(Rj - dj)(R k - d k )] - iJ jk , (18) 

which is called covariance of canonical variables. The real symmetric matrix 
(jjk) is called the covariance matrix 7. Note that due to our choice of canonical 
variables, R 2 j-i = &j and R 2 j = uo~ l ^ 2 pj (j = 1, 2, • • • , n), the trace of the 
principal sub-matrix of the jth mode of 7, 



7b1 



72j-l,2j-l 72j-l,2j 
V 72j,2j-l 72j,2j 

gives the energy of the jth mode if d 2 j-i = d 2 j = 0; 

1 , , // + \ 1 



-^k (T2i-l,2j-l + l2j,2j) = (^(«j a J 



2 



A density operator p is a positive (semi-)definite operator (p > 0) with Trp = 
1. If p ^ 0, it does not describe a physical state. The condition for a physical 
Gaussian state is given in terms of the covariance matrix as follows [19,29]. 

Theorem 1.- Matrix 7 is the covariance matrix of a physical state if and only 
if 7 + i J > 0. A Gaussian state is pure if and only if det 7 = 1. 

From this theorem, it can be shown that dim[Ker(7 + ij)] = | dimX. Here, 
X denotes the phase space. 

Theorem 2.- If the characteristic function of a bipartite state density operator 
Pab is Xab(0 = Xab{£a,£b) with £ T = (£l,6l)> th e characteristic function 
for the density operator in subspace B is Xb(£b) = Xab(£a = 0,£_b)- 

The proof is very simple: Since Pb = Tr^p^^, the characteristic function in 
subspace B is 

Xb = TT B (p B e^ R -) = Tr( PAB e*» R *) = Tr(p AB e^ R * + ^ R -)\ u=0 
which is just Xab(0,£b)- 
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Linear transformation is rather useful in calculating the Gaussian character- 
istic functions. A linear transformation on canonical variables is written as 
R — > R' = MR. Since the new variables R' also must conserve the CCR 
[R'j,R' k ] = iJjki MJM T = J must hold. Such a linear transformation pre- 
serving the CCR is called canonical transformation and a 2n x 2n real matrix 
satisfying MJM T = J is called symplectic matrix, M G Sp(2n,M.). The in- 
verse of M is given by M~ l = JM T J~ x . If M is Symplectic, M~ l and M T 
are also symplectic and detM = 1 [30]. One of the most important properties 
of symplectic matrices is the following Williamson's theorem [31]. 

For a real symmetric positive-definite 2n x 2n matrix A = A T > 0, there exists 

a symplectic matrix M e Sp(2n, R) such that MAM T = diag(«i, «2> K 2> • " * > K n K n) 

with Ki > (i — 1, 2, ■ ■ ■ , n). 

A linear canonical transformation corresponds to a unitary transformation in 
the Hilbert space. Such a unitary transformation is defined by 

S ] M4l RS M4 ,=MR + d' 

and d! is a 2m-dimensional real vector. Consequently, S M d ,W(^)SM,d' = VV(M^) exp(i£ T d') 
and the density operator is changed to p — SM,d'pS M d ,. Suppose p is a Gaus- 
sian state with covariance matrix 7 and displacement d. Omitting the sub- 
scripts of S]M,d>, we can formula the characteristic function of the new state 
p = SpS^ as follows 



Tr[Sp£fiW(£)] = Tr\p£fiW(£)S\ = Tr[pexp(^ T 5 t J R5)] 

1 



exp 



■^ T M 7 M T ^ + if(d' + Md) 



exp 



(19) 



and 7 = M7M 71 and d = d' + Md. Therefore we conclude 

Theorem 3: Suppose the covariance matrix is 7 and the displacement vector 
is d for density operator p. The characteristic function for density operator 
p = SpS^ must be exp (-^ T 7^ + i£ T d) with 7 = M 7 M T and d = d' + Md, 
if the unitary operator S satisfies S^RS = MR + d'. 

The linear transforms can be implemented by optical elements such as beam 
splitters, phase shifters, and squeezers. For example, a (phase-free) beam split- 
ter transforms the field operators a\ and 02 as follows. 




cos 9 sin 9 
— sin 9 cos 9 
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Thus the corresponding symplectic matrix takes the form 

/ „„ r , a n a n \ 



M, 



Us 



cos 9 





sin# 





cos# 





— sin 9 





cos# 





— sin 9 






(20) 



Given that the transmission rate and reflection rate of the beam splitter are 
given by T = cos 2 9 and R = sin 2 9, respectively. The (single mode) squeezer 
with squeezing parameter r transforms the field operator a into a cosh r + 
sinh r and the corresponding symplectic matrix S sq takes the form 



M, 



sq 



diag(e~ 



(21) 



Besides the characteristic function, there are other forms of distribution func- 
tions which can also represent the quantum states. One of them is the famous 
Winger function. The Wigner function is defined as the symplectic Fourier 
transform of characteristic function, 



w(0 



(2vr 



J— J d 2n V e-^ X (v)dv. 



(22) 



For a Gaussian state, its Wigner function is also a Gaussian function. After 
performing the Gaussian integration, we obtain 



7r"Vdet 7 



exp 



■tt-<0V(f-d) 



Here, 7 _1 is the Wigner correlation matrix. Therefore the Wigner correla- 
tion matrix of p = SpS* 1 is M~ 1 7~ 1 (M T ) _1 , if 7 _1 is the correlation matrix 
of p and S^RS = MR. The Wigner function is similar to a classical probabil- 
ity distribution in position-momentum. For example, consider the one-mode 
Wigner function and denote £i — x, £ 2 = P, 



W(x,p)dxdp 



(23) 



and JW(x,p)dx, J W(x,p)dp are for the classical probability distributions 
over momentum space (variant p) and position space (variant q), respectively. 

An n— mode density operator p can be formally expressed as the diagonal form 
with respect to the n mode coherent state a 2 , • • • , a n ) = ®^ =1 \aik) as 



r n 

P = / II d 2 a k P(a 1 , a 2 , ■ ■ ■ , a n ) \a x , a 2 , • ■ ■ , a n ) a 2 , 

J k=i 



(24) 
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This expression is called the P representation of the density operator p, and 
P(oii, «2, • • • , cx. n ) is called the P function. Such a representation exists for any 
density operator provided that the P function is permitted to be singular [6]. 
In Eq. (24), 



1 , „\ ^ K) J 



a k ) = exp ( -- \a k \ ) J2 ^yjf \j) 



(25) 



with \j) = (i!) _1/2 (4) j |0>, and d 2 a = dReadlma. The coherent state [Eq. (25)] 
is an eigenstate of a k ; 



a k \oik) = ak \a>k) 
and satisfies the completeness relation, 



(26) 



fd 2 a 
/ \a) {a\ = 1. 

J 7T 



(27) 



The P function is written as 



1 r n ( n \ 

P{a u a 2 , ■ ■ ■ , a n ) = — / Y[ d 2 Vk exp a kVk ~ a kVk Xn{Vi,V2, ■ ■ • , Vn)- 
71 J k=i \k=i J 

(28) 

Here, 



Xn(Vi,V2,--- ,Vn) = Tr 



pexp [J2 Vka{ exp ( - J2 vt^k 



\k=l 



k=l 



is the normally ordered characteristic function. The normally ordered charac- 
teristic function is also written as 



XN(r)i,V2, ■ ■• ,Vn) =Tr 



p ex p X! w4 - vi^k 



<k=l 



exp ( \j2\Vj\ 



(29) 



Here, if we write £2*1-1 = v^2Re?7fc and £2/0 = — V^Imr/fc (k = 1,2, ■■• , n), 
Efc=i(%4 - 7]* k a k ) = Efc=i(-*6*^fc + i&k-iPk) = ii T JR ■ This shows that 
Tr[---] in the right-hand side of Eq. (29) is nothing but the characteristic 
function. The P function can be thus written in terms of the characteristic 
function. 



Here, we derive the trace formula of Weyl operator, which is used in Sec. 5.2.2. 
Using Eqs. (26) and (27), we have 
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k=l 

'1 



W(0 = II ex P (^4 - V* k a k ] 

k=l 

II exp 0- |%| 2 ] exp (-rf k a k ) exp (^4) 



fc=i 



-VkY (jjk) r | w I f* 



ft exp gkl 2 )/ 



7T 



a fc ) (a fe | exp (^c^ - rf k a k ) . 



Therefore, 



W(0=flexp (%| 2 ) /^exp 

fc=l V2 / J 7T 



Since 



we have 



f — — exp (rja* — t]*a) = 7i5(Rer])5(lmri), 

J IX 

TrW(0 = (2n) n 5(0. 



(30) 



1.3 Coherent states 



Lets start from the simplest state, the vacuum, i.e., the density operator |0) (0|. 
According to the definition, the characteristic function is 

oo 

= Tre^ l£+6?5) |0)(0| = ^(n|e^ l£+?2?5) |0) (0|n|) = (0|e^ lS+ ^|0). 



Given that x — 775 + a) and p = -j^(a) — a), we have 



Here we have used the following well known operator identity[5,6] 



exp(f2i + fi 2 ) = exp(— - [Jli, f2 2 ]) exp fix exp Q 2 



(31) 



(32) 



if [Sli, [fii,0 2 ]] = [ft 2 , [fii,fi 2 ]] = 0[6]. Putting this back into Eq.(31) we im- 
mediately obtain the following explicit formula for the characteristic function 
of vacuum 



x(£i,6)=exp[-(tf + £)/4]=exp 



-|(6,6)7o 



6 

e 2 



(33) 
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Therefore, the characteristic function of vacuum state is indeed in the Gaus- 
sian form and the covariance matrix 70 here is simply a 2 x 2 unity matrix. 
Based on this fact, through linear transformations, one can easily write out 
the characteristic function of a coherent state [5], the characteristic function a 
squeezed (vacuum) state, and many other Gaussin states. The state of a light 
beam out of a laser device is coherent state[5]. (For a systematic study of co- 
herent states and squeezed states, one may go into more specific reviews, such 
as[6,8,9,10] or quantum optics textbooks, e.g. [8,15,16,17,18].) The following 
well known Baker- Campbell-Hausdorff (BCH) formula is particularly useful 
in studying the linear transformations: 

e'Ve-" = u + [/x, u\ + I [/i, \pt, u\\ + | [/x, »}}} + ■■■ (34) 

Here /1 and v are two arbitrary operators and v\ = fiu — ufi. A displacement 
operator is defined as 

D(d Xj d p ) = exp(id p x — id x p) = exp[(<W — a*a)/V2] = V(a/V2) (35) 

and d x , d p are real numbers satisfying d x + id p = a. Using Eq.(34) we can 
easily obtain 

T>\a)(a\ a)V(a) = (a^+a*, a+a); D ji (d x ,d p )(x,p)D(d x ,d p ) = (x+d x ,p+d p ). 

(36) 

The coherent state 

00 n 

l«) = e"H 2 / 2 E^H- (37) 
n=o v n\ 

is equivalent to 

| a ) = e o*t_|ap/2 1 0) =V(a)\ 0). (38) 
Here we have used the the operator identity of Eq.(32) and fact |0) = e a * a |0). 

The coherent states is a member of Gaussian states. Since the coherent state 
\a) can be regarded as the displaced vacuum of T>(a)\0), according to theorem 
3 its characteristic function is simply 



X(£i>6) = exp 



(39) 



based on the characteristic function of vacuum state in Eq.(33). This is a 
Gaussian function. 



Coherent states are a type of minimum uncertainty states for quadrature op- 
erator x, p. Since x and p don't commute, the following uncertainty relation 
must be respected given any state: 

«x 2 > - (x) 2 ) ■ ((p 2 ) - (p) 2 ) > \[x,p]/2\ 2 = 1/4. (40) 
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Q2 




Fig. 1. Any coherent state \a) can be represented by an error circle with radius of 
1/2 and a displacement q± = \^2Re(a) and q2 = V^Imo;. 

Here we have used the fact 

[x,p]=i. (41) 

The commutation relation of quadrature operators x, p is the same with that 
of position operator and momentum operator in quantum mechanics, we also 
call operators x,p as "position operator" or "momentum operator" for con- 
venience. According to Eq.(39), the covariance matrix of any coherent state 
is a unity matrix which indicates ((x — (x)) 2 ) = ((p — (p)) 2 ) = 1/2. This is 
equivalent to ((x 2 ) — (x) 2 ) ■ {(p 2 ) — (p) 2 ) = 1/4 which is the minimum value 
as requested by the uncertain principle. 

Intuitively, the coherent state |a) can be represented by a displaced error circle 
as shown in fig.(l). 

The averaged photon number of coherent state \a) is 

/i = (a|cr a|o:) = \a\ 2 . (42) 

This is the intensity of coherent state \a). A coherent state can also be char- 
acterized by its intensity and phase, i.e., a coherent state with intensity /x and 
phase 9 is 

|^,0) = eVP^-A^o) (43) 

with (j, — \a\ 2 and e ld = a/\a\. Doing Taylor expansion to operator e Qat and 
using the property of a)\n) = l\n + 1) we have the following linear 

superposition form for the coherent state in photon-number space: 

oo n/2 p ind 

n=o Vnl 
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The phase 6 of light pulse from an ordinary laser device is random. If the phase 
is random, a coherent state with intensity /i is actually a classical mixture with 
Poissonian distribution of photon number states: 



1 r 27T n n 

p, = tt M><MI = e-*E*TMH ( 45 ) 

2,71 Jo n n - 

If fi is small, a light pulse in the state above is almost the same with a single- 
photon pulse if it is not vacuum. Therefore the weak coherent light is often 
regarded as the approximate single-photon light. All properties of a coherent 
state can be simulated by a classical Gaussian light. Therefore a coherent 
state is regarded as a classical state. Also, any classical probabilistic mixture 
of different coherent states is also a classical state, i.e., state 

j P(a)\a)(a\d 2 a (46) 

is classical if P(a) is positive-definite. 

1.4 Squeezed states 

Besides coherent states, a more general class of minimum-uncertainty states 
are known as the squeezed states. In general, squeezed states may have less 
uncertainty in one quadrature than that of coherent states. Due to the re- 
quirement of the uncertainty principle, the noise in the other quadrature of a 
squeezed state must be larger than that of the coherent states. Most generally, 
a state is called squeezed if its covariance matrix has an eigenvalue smaller 
than one. 

l.^.l One-mode squeezed states 

The simplest single mode squeezed state is the squeezed vacuum state, 

IC,0> = S(C)|0> (47) 
generated by the squeezing operator 

S(C) = exp ^at 2 + ( -a^ , (48) 

from vacuum |0) where £ = rexp(z0) is an arbitrary complex number with 
modulus r and argument 0. The squeezing operator S(() is unitary because 
S't(C) = exp (^a) 2 — Y a2 ) = | S ,_1 (C) is the inverse of operator S{Q. 
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The squeezed vacuum state is a minimum-uncertainty state with the variance 
of two quadratures being different. To show this, we calculate the variance 
of quadrature operators x, p . The BCH formula of Eq. (34) gives rise to the 
following transformation 



and 



M, 



S- 1 (C)(a\a) T S(0=M ( (a\af 

( 
\ 



(49) 



(50) 



(51) 



coshr — e ^sinhr 
— e^sinhr coshr 
and it's inverse transformation is 

S{Q{a\a) T S-\Q = Ml\a\af. 

Here 

(a' , a) T = 

The transformation in x, p space is 

S-\x, p) T S = S" 1 ^, a)K} T S = [{a\ a)M c K] T = M c (x, p) T (52) 

with 




and K = 73 




M c = K~ 1 MqK 
. In the special case that C, is real, 



(53) 




(54) 



This is just Eq.(21). According to theorem 3, the covariance matrix of the 
squeezed vacuum state 5'(C)|0)(0|S' _1 is simply 







( e~ 2r \ 


(■::)- 




[ e 2r ) 




{ e'j 



(55) 



Such a covariance matrix indicates that the variance of position and momen- 
tum are e~ 2r and e 2r respectively, while the product of these two variance keeps 
to be the minimum uncertainty. The position (momentum) noise is "squeezed" 
if r is positive (negative). Most generally, ( is a complex number and the 
maximum squeezing is for the observable of rotated position. This minimum- 
uncertainty relation actually holds for the squeezed vacuum state with any 
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Fig. 2. Comparison of the variance shape of a squeezed vacuum state and vacuum, 
a displaced squeezed vacuum state and a coherent state. 1: Error circle of vacuum; 
2: Error ellipse of a squeezed vacuum; 3: error circle of a coherent state (displaced 
vacuum); 4: error ellipse of a displaced squeezed vacuum state. 

complex parameter £. Moreover, since a displacement does not change the 
variance, this minimum-uncertainty relation and the squeezed variance of x 
are also true for an arbitrary displaced squeezed vacuum state V(a)S(Q\0). 
Pictorially, one can draw the variance ellipse for a displaced squeezed state as 
shown by fig. 2. 

The squeezing operator can be normally ordered as[17]: 



s(0 



cosh|C| 



x exp 



— e*tanh|fl 



cxp 



-cr a(ln cosh |£|) 



cxp 



This leads to 



s(C)\o) 



V cosh \ 



exp 



1 2 

—w e i<?i tanhr 



-a 2 e^tanh|C| 



|0> 



(56) 



(57) 



given the fact a\0) = 0. Furthermore, by taking Taylor expansion to the ex- 
ponential operator and using eq.(14) we have 



15(010) = VsechrJ2 



n=0 



??! 



— e^tanhr 
2 



|2n). 



(5* 



From this equation, we see that state |C ; 0) is actually a linear superposition 
of even photon number states. 
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Different squeezed vacuum states are not orthogonal. By the transformation 
property, overlap between two squeezed states can be easily calculated [8]. 



(C,o|c / ,o) = (o|st(c)S(0|o). 

It can be simplified with the normally ordered form of Eq.(56) as 

(COK',0) 



(59) 



V sechrsechr'(0| exp 



— a e 
2 



'tanhr 



exp 



■-a t2 e^' tanhr' 
2 



|0> (60) 



One can transform the product operator between the two vacuum states in 
the above equation into the normally ordered form[17,32,33,34] and obtain the 
overlap of two squeezed states [9] 



(C,o|C',o) 



sechrsechr' 



1 — e 1 ^' tanh r tanh \ 



(61) 



1.4-2 Two-mode squeezed states 



The two-mode squeezed states [20] are especially useful in QIP, because they 
can be used as entanglement resource. Mathematically, similar to the one- 
mode squeezed state, a two-mode squeezed state can be generated from the 
vacuum by a two-mode squeezing operator, 



S = exp (— C a i a 2 + C a i a 2 



(62) 



where a\ and a 2 (ai and 02) are the photon creation (annihilation) operator 
of each mode. Operators of different modes commute. 

The two mode squeezing operator has the following transformation property: 



S 1 (a{, ai, g4, a 2 ) T S = M^(a\, a l5 a\, 02) 



(63) 



and 



Mr 



(64) 



Here r = |£| and re 1 ^ 
momentum space is 



cosh r e~ 1 ^ sinh r ^ 

cosh r e 1 ^ sinh r 

e~ % ^ sinh r cosh r 
e^sinhr coshr 

£ . If r is real, this transformation in the position- 



/ 



S 1 (xi,x 2 ,pi,p 2 ) T S = L(x 1 ,x 2 ,pi,p 2 ) rj 



(65) 
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and 



L = #diag(e- r ,e r ,e r ',e- r )# T , H = ^ 



( 1 -1 ^ 
10 1 
10-1 
10 1 



This means that 



S\x\ — x 2 )S = e~ r (xi — x 2 ) and S^(pi +p 2 )S' = e _r (pi + p 2 ), i.e., both fx — x 2 
and p! + p 2 are squeezed. Therefore the covariance matrix for the two-mode 
squeezed state with squeezing factor ( = r is 



lsq2 = H 1 di ag (e- 2r ,e 2r ,e 2r ,e- 2r )H. 



(66) 



The formula above gives rise to the following formula for the characteristic 
function of two-mode squeezed state 



X*j2(fi,f2,f3,f4) = exp 



" - m2 i /t ,t \2l e [Yd- i t 



■[(6 - &r + (6 + &)i - + &r + (6 - &) 

(67) 



The two mode squeezing operator can also be written in the normally ordered 
form[17,32] 



S(C) 



cosh ICI 



exp 



x exp 



a\ai + a 2 a 2 ) ln(cosh \(\) 



■ exp 



"aiWe^tanhlCl 
e -^tanh|C|aia 2 



{6i 



With this normally ordered form, the two-mode squeezed vacuum state can 
be simplified: 



>S(C)|00) = sechr ^ [exp(i0) tanhr]™ |n)i|n) 2 

n=0 



(69) 



The state of each individual mode in the two-mode squeezed state is a mixed 
state. The density operator of each mode can be calculated by taking the 
partial trace of the whole state. For example, the state for mode 1 is 



Pi = tr 2 |C,0)(C,0| = sechV ^ tanh 2n r\n)(n\. 



n=0 



This is just a thermal state of 

p th {(3) = (1-e^) exp(-Mi) 



(70) 



(71) 



and (3 = — lntanh r. According to our theorem 2, the characteristic function 
of the thermal state above can be easily deduced from Eq. (67) 

1 



Xth,p(€i,£2)(P) = exp 



(72) 
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and v = cosh2r. This means that the characteristic function in the above 
form is for a thermal state Pthifi) with 



e~ P = V -^t- (73) 



The wave-function of a two-mode squeezed state in position space is[l 1] is 



iS'(C) ] 00) = —= [ dxidx 2 exp 
V 71 " J 



e 2r e~ 2r 
■ — (xi - x 2 ) 2 ( x i + x i) 2 



(74) 



The same state in the momentum representation is 

Jlr „-2r 



1 



dpidp2 exp 



(75) 



Therefore, in the limit that r — > oo, the two-mode squeezed state has the 
following un-normalized form: 

x) 1 \x) 2 dx = J -p) 2 dp. (76) 

From this we can also see clearly the squeezing properties for a two-mode 
squeezed state in the extreme case: It is a simultaneous eigen-state of both 
(xi — x 2 ) and (pi +p 2 ) with both eigenvalues being 0. We shall call this type of 
entangled state as the EPR state or Bell state in position-momentum space. 
We shall call the simultaneous measurement of (xj — x 2 ) and (pi + f> 2 ) Bell 
measurement in position-momentum space. Most generally, the simultaneous 
eigen-state of X\ — x 2 and p\ + p 2 with eigenvalues A and E is a displaced 
two-mode squeezed state of 

oo 

\B(A, E)) = J D(A,E)exp[r(a t 1 4-aia 2 )]|00) = D(A, E)sechr ^ ^ k \kk) (77) 

fc=0 

and r — >• oo. Here D(A, E) is defined in Eq.(35) and 7 = tanhr — > 1, and we 
have used Eq.(69). 

Remark The continuous variable Bell state implies the infinite squeezing which 
doesn't exist. However, a two-mode squeezed state of finite squeezing is also 
entangled and can be used to carry out non-trivial entanglement-based tasks. 



1.5 Beam-splitter 



Beam-splitters [35,36,37,38,39] are widely used in the quantum information 
processing. A beam-splitter can work as a type of interferometric device, a 
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Fig. 3. A schematic diagram of the beam-splitter. Both the input and the output are 
two mode states. The different mode is distinguished by the propagating direction 
of the field. BS: beam-splitter. 

type of quantum entangler and also a device for Bell measurement. Lets first 
consider the elementary properties of a beam-splitter: the relation between 
the output state and input state of a beam-splitter. For clarity, we use the 
Schrodinger picture[38, 39,40,41] here. We shall define the mode by the prop- 
agation direction, for both input and output states. Consider figure 3. Both 
the input state and output state are two-mode states. Even though we have 
only sent one light beam into the beam-splitter, we shall still regard the total 
input state as a two-mode state by setting the state of another input mode to 
be vacuum. For example, the input light beam of mode 1 contains one photon 
and there is nothing in mode 2, the total input state is |l)i (g) 1 0)2 which is 
simplified by notation |10). The output state is \ip) out = Ub\10) and Ub is the 
time evolution operation caused by the beam-splitter. The specific parameters 
in Ub are determined by the material properties of the beam-splitter itself. 
However, in calculation, normally we don't need the explicit formula of Ub 
itself, we only need the transformation properties of Ub- Given any input of 
pure state, we can always write it in the two-mode form of 

|V)in = /(a!,4)|00). (78) 

After passing the beam-splitter, the state is changed to 

\i>)aut = U B f(a\,at)\00) = U B f{ala\)U B l U B m. (79) 

Considering the fact of no input no output for any beam-splitter, one imme- 
diately finds U B \00) = |00), therefore 

\^)out = U B f{ala\)U B l m = f{U B a\U B \UBa\UB l )m. (80) 
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Denote (a{, ai, 4> «2) T 



4 

Va 2 y 



.Suppose 



U B (a\, ai, 4, a 2 ) T U B 1 = M B (a\, a x , 4, a 2 ) T (81) 

then a beam-splitter is fully characterized by matrix M B , with the output 
state being explicitly given by Eq.(80), given whatever input state. Since any 
time evolution operator must be unitary, matrix M B of any beam-splitter in 
SU(2). Therefore, the most general form of matrix M B is 



' cos6»e^° 



cos 



- sin 9i 

9e -i<Po o 







\ 



sin i 







COS I 



-up 



\ 







sin I 







— sin i 



cos I 



(82) 



In the special case of a 50:50 beam-splitter, 9 = ir/A and 4>o 
matrix is 

( 1 -1 ^ 



0, the 



M B = ,= 



1 

72 



10-1 
10 1 
\0 1 1. 

In the position-momentum space, the transformation formula is 
U B (xi, pi, x 2 , p2) T U B l = M B (xi, pi, x 2 , p2) T 



53) 



/ 



with 



and K 



1 1 



Mb = (K- 1 © K~ l )M B (K © K) 
/ \/2. In the special case that 9 = 7r/4 and 



55) 
0, 



.Mb = Mb, which is given by Eq.(83). 

Summary: To write the output state of a beam-splitter, one only needs to write 
the input state in the form of f(a\, 4)|00) and then replace a\, a\ by U B a[U B l 
and Usa^U^ 1 , respectively. U B a\U B l and Ubc^Ub 1 are determined by eq.(81). 
Matrix M B is determined by the material properties of the beam-splitter itself. 
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1.5.1 Collective measurement in polarization space 

So far we have assumed that the input light beams of each mode have the 
same polarization and frequency. If the two input beams have different po- 
larization or frequency distribution, the result will be different. Beams with 
perpendicular polarizations or different frequencies will have no interference. 
For simplicity, we consider the effects caused by different polarizations here 
only. Since perpendicularly polarized photons don't have quantum interfer- 
ence, the transformation matrix M B only applies to horizontal photons and 
vertical photons separately. That is to say, we shall first write the state of the 
input light in the form of f(a\ H , a\ v , a\ H , al v )\00) and then use 



U B (a iH> a iH,0'2Hi a 2H) T U B — M B (a 1H ,ai H ,a 2H ,a2H) T 

(86) 

a ivi a Wi a 2Vi a 2v) T U B — M B (a lv , aiv, &2Vi a 2v) T 

This is to say, we shall treat H, V as different modes and the operators of 
perpendicular polarizations commute. Here the creation operators of certain 
polarization have the same property with those on a specific mode. For exam- 
ple 

4|0> = \H) = |l>//;4/|0> = V2\2H) = V2\2) H ; 

and so on. Consider the case that each input beam contains one photon, 
the polarization for beam 1 is horizontal and the polarization for beam 2 is 
vertical. The input state is \ip)in — 1-^0 i ® 1^)2 = a iH a 2V 

|00). Given a 50:50 

beam-splitter, the state of the output beams is 

Wont = ~(a\ H + a\ H )(a\ v - 4v)|00). (87) 
This is equivalent to the state 

\iP) 0Ut = \HV) 1 ® |0> 2 - \H) 1 ® \V) 2 + \V) 1 ® \H) 2 - |0>! ® \HV) 2 (88) 

and the state \HV)\ = a\ H a\ v |0), which means mode 1 contains one hori- 
zontally polarized photon and one vertically polarized photon. Given this for- 
malism, we can now show how a 50:50 beam-splitter may assist us to do the 
(incomplete) Bell measurement with single-photon detectors. Suppose each 
input mode contains one and only one photon and we have placed a single- 
photon detector at each side of the beam-splitter to detect the output light 
beam of each mode. We want to see whether the input beams are in the max- 
imally entangled state of \ip~) = ^(l-^)i ® \V)2 — \V)i ® l-^h) by watching 
the single-photon detectors. As we have known already, there are 4 states in 
Bell basis. If we want to know whether the input state is we must be 

able to exclude the other 3 states Q^), l^" 1 "))- The detectors' status caused 
by the output beams of these 3 states must be deterministically different from 
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that of For such a purpose, we consider the consequence of the 4 Bell 

states one by one. Given the input state |^ + ) = ■j%(\H)i<8>\V)2 + \V)i<gi\H)2), 
we can rewrite it into 

= -^(4tf4v + 4y«L)|00). (89) 
After passing through the 50:50 beam-splitter, the state is transformed into 

\^)out = ^[fclff + 4if)(4v ~ 4f) + (4v + <Av){<Ah ~ 4h)]|00>- ( 90 ) 

According to Eq.(80) and Eq.(83), this is equivalent to 

Wiaut = ^(4^-4X^)100) = -L(|fTV)i®|0> 3 -|0)i®|FV) 3 ). (91) 

This shows, if the input state is one mode of the output must be vacuum. 
Thus one detector must be silent. Similarly, given the input states of |0 ) = 
4§(|-H)i ® \H) 2 ±\V)i® | V) 2 ), we find that the output states are ^(|2#)i ® 
1 0) 2 + 1 0) 1 ® \2H) 2 ) ± |2 V ) 1 ® 1 0} 2 ± 1 0) 1 <g) 1 2V) 2) . This also shows that , given the 
input state \<p + ) or \<f>~), one output beam must be vacuum thus one detector 
must be silent. 

But what happens if the input state is ? Given the input of 

Mi» = l^~> = ^(4^4v " 4y4//)|00) (92) 
the output state must be 

\^)out = + 4u)(4v - 4v0 - (4v + a lv)( a iH ~ 4h)]I°°) ( 93 ) 

which is equivalent to 



-^(4h4f-4v4h)|00) = --^ 



)out = -^=(a\ H al v -a\ v al H )\00) = -^-(\H) 1 ®\V) 2 -\V) 1 ®\H) 2 ). (94) 



This is to say, each output beam contains 1 photon. Therefore, if both detectors 
click, the input beams must be in One may go into [41,12] for the historic 
development of collective measurement by a beam-splitter. 

Summary: We can regard two perpendicular polarizations as two modes and 
treat each polarization separately. A 50:50 beam-splitter can help us do an 
incomplete Bell measurement in polarization space. Suppose each input beam 
contains one photon, if both detectors in the output space click, then we judge 
that the input light must have been collapsed into \ip~)- 
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1.5.2 Bell measurement in quadrature space through homodyne detection. 

Now we consider the Bell measurement in a type of continuous basis, say, 
in the coordinate basis of the eigenstates of position difference X\ — x 2 and 
momentum sum pi + p 2 - Since the operator x\ — x 2 and p\ + p 2 commute, the 
two measurements can be done simultaneously in principle. To measure these 
two quantities, we only need a 50:50 beam-splitter as shown in figure 3. Given 
the 50:50 beam-splitter as defined by Eq.(83), measuring the momentum of 
the output mode 1' is equivalent to a collective measurement of f>\ + p 2 on the 
input beams and measuring the position of output mode 2' is equivalent to 
the collective measurement of x\ — x 2 on the input beams since the following 
transformation happens in the Heisenberg picture 

Pi' = UbPiUb = ; x 2 ' = U B x 2 U B = . (95) 

Therefore, given a 50:50 beam-splitter, the Bell measurement to two input 
beams is reduced to the local measurements of position and momentum on 
each output modes. The only technical problem remaining now is how to 
measure the coordinate of the output beam 1' and and momentum of beam 
2'. This can be done by the homodyne detection[42, 43, 44,45,46]. 

As shown earlier, the states in Fock space can be represented in the position- 
momentum basis, i.e., the eigen-states of x{6) = -^(a^ e ld +ae~ l9 ) , {\xg)(xg\,xe G 
(—00, +00)}. However, the photon detector itself only projects a state into the 
photon number states. To measure a state in the basis of {|xe)(x6/|} by pho- 
ton detectors, we need a bright classical light beam, which is called as "local 
oscillator". In the measurement, the signal light is "phase locked" to the local 
oscillator. The local oscillator is a coherent state \cx)l and is denoted by "L" 
in Fig. (4). We use the set-up to take quadrature measurement on the signal 
beam, beam S. What is observed is actually the photon number difference of 
two output modes, i.e., 

(AN) = (i) ou t\a} s a s - a ] L a L \%l) out ) = (^(L^ 1 (a j s a s - a[a L ^ U B \i>in)- (96) 

Based on the last equality of the equation above, the photon number difference 
of the two output modes can be equivalently regarded as the measurement out- 
come of U B l (a} s a s — a L aij Ub = a^ai + a) L as on input state \ipi n ), i.e., the 
state of light beams S and L. In this picture we have regarded the beam- 
splitter itself as part of the measurement device. Since the local oscillator is a 
very strong bright light in coherent state (e~' Q ' 2//2+Qa i |0)), operator can be 
replaced by a. Therefore the observed result of the photon number difference 
of the output modes is actually the observation of 

\a\(a<e i6 + ae~ i6 ) = V2\a\x(9) (97) 

to the input mode S, i.e., a measurement to input mode S in the rotated 
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s 




L 

local oscillator 

Fig. 4. Balanced homodyne detection with a 50:50 beam-splitter. By observing the 
current induced by the photon difference of beam 1 and beam 2, one measures signal 
beam, beam S by operator x(9) and 6 is dependent on the state of local oscillator, 
beam L. 

position space. 

Remark: Normally, 9 value is unknown if beam L is from a normal laser de- 
vice. What we have known is that we have observed x(9) and 9 is the phase 
parameter of beam L. This is to say, we don't know the phase value but all 
pulses have the same phase (phase locking). 

As an application, we now demonstrate how to detect the position fluctuation 
squeezing of a squeezed state. Given a single-mode squeezed state 5(C) |0) and 
5(C) = exp(— |al~ 2 + ya 2 ), C = |Cl eJ<? \ we nn d the quadrature fluctuation 

((Ax(9)) 2 } = |[exp(-2|C|) cos 2 (£ - 0/2) + exp(2|C|) sin 2 (# - 0/2)] (98) 

We see that the fluctuation of x will be less than 1/2 provided that \9 — 0/2 1 
is not too large. In the experiment, the squeezed state is always phase-locked 
to the local oscillator. Explicitly, one can produce many copies of input states 
and the local oscillator and the value of and 9 have a fixed relationship, e.g., 
= 20. 

The position squeezing is verified if one finds that the fluctuation of x(9) is 
less than 1/4, i.e., 

(4> - M* < 1/2- (99) 
here xei is the observed value of the ith signal, (yi) is the averaged value of all 
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Fig. 5. Verifying the position fluctuation squeezing. The squeezed state is produced 
after the pump light pass through the cavity (squeezer). 

Hi. The set-up is drawn in fig. (5). Since every squeezed state is phase-locked to 
the local oscillator, we can set (p — 9 to be quite small in the experiment. With 
the observed position values of many copies of squeezed states, the position 
fluctuation can be calculated by Eq.(99). 

Knowing how to measure the position, one can easily know how to do the Bell 
measurement. We demonstrate it by x\ — x 2 - Consider figure 3. Measuring 
the quantity of x\ — x 2 and p\ + p 2 of the light beam 1 and 2 is equivalent 
to measure x and p respectively to beam 1' and 2'. The individual position 
measurement to beam 1' and momentum measurement to beam 2' can be 
done by the homodyne detection as shown already. Suppose the state of beam 
1 and 2 is \ipi n ) and the state of beam V, 2' is Measurement outcome of 
the position of beam V is 



(ij/\x ® = (AuIUb 1 (x (8) 1) U B \i/> in ) = (if} in \ (zi - x 2 ) \i) in ). (100) 



In short, using beam-splitters and strong reference light, one can do the Bell 
measurement in position- momentum space, i.e., one can measure x\ — x 2 and 
Pi + p2 simultaneously. 

Remark: Different from the case of beam-splitter collective measurement in 
the two-photon polarization space, here the Bell measurement in position- 
momentum space is complete, deterministic while the one in two-photon po- 
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larization space is incomplete (can only judge whether the state is \ip~)), 
non-deterministic and normally with post selection only This is an important 
advantage of Gaussian states in QIP. 



1.6 Beam-splitter as an entangler 

A beam-splitter can work as a type of quantum entangler. For example, given a 
50:50 beam-splitter and the input beam of mode 1 containing one photon mode 
2 containing nothing. The output state is^=(|10) + |01)). Obviously, this is a 
maximally entangled state in vacuum-and-one-photon space. However, given 
another input state, the output state can be separable. For example, if the 
input is vacuum or a coherent state, the output is still vacuum or a (2-mode) 
coherent state. Actually, the output state is never entangled if the two-mode 
input state is classical (probabilistic mixture of coherent states). This can be 
regarded as a theorem. The proof is very simple: Any 2-mode coherent state 
\olx) ® \a 2 ) will simply become another 2-mode coherent state \ai) <S> \ot 2 ) after 
the beam-splitter transformation. Therefore, after passing the beam-splitter, 
the state will be another probabilistic mixture of coherent states which is still 
a classical state and must be separable (unentangled). Actually, no matter how 
many beam-splitters are used, the final multi-mode state must be separable 
given that the input light is in a classical state. Details can be seen in Ref . [38] 

Given the input of non-classical light, the output can be either entangled or 
unentangled[39]. We now demonstrate the entanglement property when two 
one-mode squeezed states are used as the input. Suppose the input states are 
the squeezed vacuum states in each mode, i.e. 

Pin = S(Q ® S(( b )\00)(00\S\( a )S\( b ), (101) 

where S a (( a ), Sb(Cb) are squeezing operators defined by 5(C) in Eq.(48). (Here 
(a = r a e l ^ a , Cfe = rf,e z ^ b .) The two- mode output state is a pure state and can 
be entangled. The quantity of entanglement of the output state is determined 
by the impurity of one mode. Suppose the output state of mode a is p oa . The 
quantity of entanglement of the output state is[l] 

E(p oa ) = tr(p oa lnp oa ). (102) 

After passing the beam-splitter, the two-mode state is 

U B S(( a )®S(( h )\00)=U\00). (103) 

As stated earlier in theorem 3, the covariance matrix of the output state can 
be derived based on the vacuum covariance matrix and the transformation 
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property of U. Explicitly, 



U ] (x a , p a , x b , p b ) T U = (M (a <S>M (b ) ■ M B x {x a , p a , x b , p b ) T 

and A4( a , M.( b are defined by Eq.(53), M.b is given in Eq.(84). Therefore 
the covariance matrix for the two-mode state after passing through the beam- 
splitter is 



(104) 



and jin is the characteristic matrix of the two-mode in-put state. This can be 
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written in the 2x2 block form of | a a | and 7^ 
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covariance matrix of mode a of the output state. The matrix elements of 7^ 
can be explicitly calculated from Eq.(104). Since the entanglement quantity 
as defined by Eq.(102) is unchanged by any local unitary operation, using 
an appropriate symplectic transformation, we can first transform 7^ into the 



diagonal form 



v 
v 



and 



v = V m n m 22 - mii- 



(105) 



This is the covariance matrix of a thermal state. Thus the quantity of entan- 
glement for the output state is: 



E{p c 



In 
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v+1 



(106) 



The above equation together with the previous equations for the definition of v 
formulates explicitly the entanglement quantity. The maximum entanglement 
is achieved through maximizing v. This requests 



2(0i - fa) - (<p b - <Pa) = (2k + 1)tt, (107) 
where k is an arbitrary integer [39]. 

Summary: A beam-splitter can never produce entanglment with classical light. 
One can produce two-mode squeezed states given one-mode squeezed states 
and a beam-splitter. The entanglement of the output states can be optimized 
by adjusting the phase parameters of the input squeezed states. 
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2 Entanglement-based quantum tasks 

Many important tasks in QIP are based on quantum entanglement. They 
either directly need quantum entanglement resource, e.g., quantum teleporta- 
tion and dense coding, or the entanglement manipulation, e.g., entanglement 
purification, or creating entanglement in carrying out the tasks, e.g., cloning 
or quantum error correction, and so on. We shall review most of these tasks 
with Gaussian states in this section. But the issue of entanglement purifica- 
tion of strong bipartite Gaussian states is not included in this section since we 
have placed it in another section which is focus on the mathematical theory 
of quantum entanglement of Gaussian states. We now start with quantum 
teleportation. 



2.1 Teleportation with two-level states 

The idea of quantum teleportation was first proposed in 1993 [4] with two- level 
systems. Suppose a photon with Alice is in an unknown two-level quantum 
state in e.g., the polarization space. Definitely, if Alice wants to send the 
unknown quantum state to a remote party Bob, she can choose to simply 
send the photon to Bob. However, with the help of quantum entanglement, 
she has a better choice. Instead of sending the photon itself, she can only move 
the unknown quantum state onto a photon at Bob's side while not sending any 
physical particle to Bob, if she has pre-shared an EPR pair with Bob. By this 
method, in order to send any quantum information (unknown quantum state) 
to a remote party, one does not have to send its physical carrier. This process 
is called as quantum teleportation[4]. It is a bit different from the classical 
teleportation: here once an unknown state is teleported to a remote party, its 
original carrier has lost all information of the state. Alice cannot choose to read 
the state ( measure the state) first and then announce the result, because the 
original unknown state is changed once she reads it. Alice can neither choose 
to copy the state first and then send one copy to Bob, since the perfect cloning 
is forbidden by quantum non-cloning theorem[47]. 

2.1.1 Teleportation with two-level systems 

The task of quantum teleportation [4] can be achieved if they have pre-shared 
quantum entanglement. In figure 6, Alice and Bob initially share a perfect 
EPR pair, particle 2 and 3. Particle 2 is with Alice and particle 3 is with 
Bob. The two-level state of particle 1 with Alice is unknown. Alice measures 
particle 1 and 2 in the Bell basis first, then remotely instructs Bob taking 
a local unitary transformation according to her measurement outcome. After 
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Bell Measurement 



1 2 3 

Alice Bob 

Fig. 6. Quantum teleportation. Alice and Bob pre-share an EPR pair ( photon 
2 and 3). The unknown quantum state is initially carried on photon 1. The Bell 
measurement outcome at Alice's side is then broadcast. 

the local unitary transformation to particle 3 is done, particle 3 is exactly 
in the initial unknown state of particle 1. Now we demonstrate the idea by 
photon polarization. Suppose the unknown polarization state of photon 1 is 

\ X )x = a\H) x + p\V) x (108) 

and a, j3 are complex amplitudes satisfying | or | 2 + \[3\ 2 = 1. Photon 2 and 3 
are in a maximally entangled state in polarization space, e.g.: 

\r ) 23 = (\H)2\V) 3 - \V) 2 \H) 3 ) , (109) 

where \H) and | V) represents the horizontally- and vertically-polarized photon 
state, respectively. The initial state of all three photons is 

|^>123 = |x)l|^~>23, (HO) 

which can be equivalently written in 



1 



'123 - 2 



-|^-)12|X)3-|^ + )1 2 («I^)3-/9|^) 3 

H<f>-)iMVh + P\Hh) + \4> + )n(a\V) 3 - /3\H) 3 



'11V, 



One can easily see that after observing the outcome of Bell measurement on 
photon 1 and 2, the corresponding local unitary transformation to photon 3 
will produce the initial state \x) on photon 3. 

Remark: Quantum teleportation does not offer any faster-than-light communi- 
cation. Bob can only produce state \x) on photon 3 overtaking an appropriate 
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local unitary transformation instructed by Alice through classical communi- 
cation which cannot be faster than light. Without Alice's message about the 
outcome of her Bell measurement, the state of Bob's photon is not changed 
at all. 

In fact, the initial unknown state is not necessarily a pure state. It can be an 
arbitrary mixed state. Moreover, it can even be a part of a composite state. 
This can be demonstrated in the concept of entanglement swapping[48]. For 
example, if initially photon 1 is entangled with photon and the state for the 
composite system of photon 1 and is an antisymmetric state \ip~)oi- The 
total state of photon 0,1,2, and 3 is 

|V>)oi23 = l(\H)o\Vh - \V) \H) 1 )(\H) 2 \V) 3 - \V) 2 \H) 3 ). (112) 

After a Bell measurement on photon 1 and 2, these two photons will be pro- 
jected onto one of the 4 Bell states. To see what happens to photon and 
photon 3, we now recast the above state in 

\{\^ + )^ + )l2 + |V")03^") 12 + |0 + )O3|0 + )12 + |^->03|V'")l2). (H3) 

This means, in all cases photon and photon 3 becomes entangled despite the 
fact that they have never been interacted. This is the so called entanglement 
swapping [48]. 

Quantum entanglement itself can also help to raise the channel capacity of 
communication through quantum dense coding[49]. If they pre-share an EPR 
pair, Alice at her side can change the state of the whole pair into any one of 
the 4 Bell states. This helps her to transmit 2 bits information by sending one 
qubit. 

The task of quantum teleportation can also be done in position-momentum 
space with continuous variable states [50], which is called as continuous vari- 
able quantum teleportation, CVQT. One can use a two-mode Gaussian state 
as the entanglement resource which is pre-shared between Alice and Bob. Alice 
can then teleport an unknown state. If they have pre-shared perfect entan- 
glement resource, they can teleport an arbitrary continuous variable state. 
Perfect entanglement means infinite squeezing which doesn't exist in prac- 
tice. Luckily, if the unknown state is limited to the family of coherent states, 
one can teleport it with satisfactory fidelity through the practically existing 
two-mode finitely squeezed states. 
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2.2 CVQT with Gaussian states 

Similar to that of the 2-level states, given the pre-shared two-mode squeezed 
states, the CVQT can be performed to transfer the quantum state of mode 1 
to the remote mode 3. Suppose Alice and Bob have three light beams, beam 
1 and beam 2 are with Alice, beam 3 is with Bob. Beam 2 and 3 are in an 
entangled state, e.g., a two mode squeezed state. Their goal is to transfer the 
state of beam 1 into the remote mode 3 through the entangled beams 2 and 
3. The task can be completed by the following 3 steps: 

• 1. Alice takes the Bell measurement on beam 1 and beam 2, i.e., measuring 
both i\ — x 2 and p\ +p 2 . Suppose she has observed A and E as the outcome. 

• 2. Alice announces her measurement outcome A and E. 

• 3. Bob displaces beam 3 by A in position and E in momentum space. 

The state of beam 3 with Bob is now the outcome state of CVQT. There are 
3 main theoretical approaches to CVQT with two-mode squeezed states: the 
Heisenberg picture [51], the phase-space representation [52] and the Schrodinger 
picture [53,54,55]. 

2.2.1 CVQT in the Heisenberg picture 

The first proposal of CVQT was presented in the Heisenberg picture [51]. For 
clarity, we start from the case with perfect entanglement. Actually, the first 
proposal of CVQT assumed the perfect entanglement [51]. Say, initially, the 
light beams of mode 1 and mode 2 are maximally entangled, i.e., 

x 2 -x 3 = 0; p 2 + p 3 = 0. (114) 

The light beam of mode is the unknown field to be teleported. Alice then 
performs Bell measurement i.e., simultaneous measurement of X\ — x 2 and 
pi + p 2 on mode 1 and mode 2. Suppose she has obtained 

x\ - x 2 = A, pi +p 2 = E 

and A, E are real numbers as Alice's measurement outcome. Given this out- 
come and Eq.(114), the field of mode 3 can be expressed in 

x 3 = x x - A; p 3 = pi - E. 

After taking a displacement of A to x 3 and E to ^3 Bob can obtain the following 
result for mode 3 as the outcome field of the quantum teleportation: 

X 3 >Xtel=X\]fa >Ptel=Pl- (115) 
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The field of mode 3 after teleportation is exactly equal to the initial field of 
mode 1. 

In practice, the maximal entanglement resource is replaced by the two-mode 
squeezed state. In such according to Eq.(65), the initial field of the 

two- mode squeezed state is: 

x 2 - x 3 = e~ r (x { 2 0) - P2 + P3 = e~ r (p { 2 0) + p ( 3 0) ) (116) 

and the superscript "0" indicates the vacuum field. Given such an imperfect 
entanglement, the outcome field of mode 2 after quantum teleportation is 

x 3 — > xtei = xi + e" r (x2 0) - xf'); p 3 — > ptei = pi + e~ r (p^ +pf ) )- (117) 

The result is the same with the ideal one in the limit of r — > +oo. However, 
if r is finite, there will be noise for the outcome field. 

2.2.2 CVQT in phase space representation 

The teleportation outcome can also be presented in the phase space represen- 
tation. In the original paper of phase space representation CVQT, the Wigner 
function is used. Here we use the the characteristic functions only. 

There are three modes (light beams) in CVQT: mode 1 for the unknown state 
which is to be teleported; mode 2 and 3 are for the bipartite entangled state 
pre-shared by Alice and Bob. Also, there are three steps in the CVQT: 1. 
Alice takes Bell measurement on beam light 1 and 2; 2. Alice announces her 
measurement outcome of A for (xi — x 2 ) and E for (pi +p 2 ). Bob displaces his 
light beam, beam 3 by A in "position" space and £ in "momentum" space. 

The displacement operator for Bob in step 3 is -D(A, S) = exp(ix 3 £ — 2j3 3 A) 
as defined in Eq.(35). It would make no difference to the final outcome of the 
above stated CVQT if step 2 and step 3 above were replaced by the following 
non-local operator in step 3 

G = exp[-ip 3 (xi - x 2 )}exp[ix 3 (pi + p 2 )}- (118) 

This operator is non-local therefore cannot be implemented in any real tele- 
portation set-up. However, mathematically, the outcome state of the standard 
CVQT procedure is identical to that from the imagined one with such a non- 
local operator. We shall use this virtual procedure to deduce the general result 
of the outcome state of CVQT mathematically. Here we consider the ensemble 
outcome state of the CVQT with Bob, i.e., the state averaged over all possible 
values of A and S. If operator G were used, actually, Bob didn't need the clas- 
sical information announced by Alice in step 2, since we only care about the 
ensemble result of CVQT outcome here. Since the measurement operation in 
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step 1 and the displacement operator G commute, if one exchanges the order 
of the Bell measurement and G operation, the result should be unchanged. 
Therefore the ensemble result of the transferred state after the CVQT is 

Ptel = Tr li2 (G PlP2Z G~ l ) . (119) 

Here p\ and P23 are the initial unknown state of mode 1 and the pre-shared 
entangled state of mode 2 and 3, respectively. In this virtual protocol, there 
is no classical communication between Alice and Bob. Therefore the delayed 
Bell measurement at Alice's side can be actually omitted because the outcome 
state at Bob's side after unitary operation G will be unchanged no matter 
whether Alice does the Bell measurement at her side. Therefore to calculate 
the outcome state, we only need to first take unitary operation G and then 
take sub-trace of mode 1 and mode 2. 

Denote the initial characteristic function for the three-mode state to be 

Xo(0 = 6) • X2 3 (6, U, 6>, 60 ■ (120) 

£2) is the characteristic function of mode 1, X23(&, £4, £5, £e) is the char- 
acteristic function for the pre-shared entangled state (mode 2 and 3). Applying 
theorem 2 in section 1 to Eq. (119), we have the following characteristic func- 
tion of the CVQT outcome state 

60 = Xo(M T o | a=6=6=f4=0 (121) 

where M is defined as 

G ] RG = MR (122) 
and R = (x±,pi, x 2 ,p2, ^3,P 3 ) T . Using Eq. (34), one can easily find: 
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Given this matrix, the characteristic function of the 3-mode state after unitary 
transformation G is 

x' o (0 = xo(m t o = Xl (^ 1+ ^ 5j ^ + e 6 ) X2 3(e 3 -£B,£ 2 +e 6 , -6-^3+6, -6+^+6). 

(124) 
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According to theorem 2, the characteristic function for mode 3 after telepor- 
tation is simply 



Xtel = Xo(M 0ki=6=6=?4=0 = Xl(6»&)X23(-6>, £6,65,6)) 



(125) 



which is just 



Xtei{^, &) = Xife, 6>) exp - -e^fe 2 + $) 



(126) 



Here we have used Eq. (67). From this we can see that there will be excess 
noise in the outcome state of teleportation, if r is finite. 

Similar to that of the two-level state, here one can also use the two-mode 
squeezed state to teleport quantum entanglement [50,56,57,58,59]. Say, ini- 
tially, there are 2 two-mode squeezed states of beam 1,2 with squeezing pa- 
rameter r a and beam 3, 4 with squeezing parameter r&. After measuring beam 
2,3 in the Bell basis, and an appropriate displacement operation on beam 1 
and beam 4, one can obtained a two-mode squeezed state for beam 1 and 
beam 4. The displacement can be carefully chosen so as to always obtain 
the same two-mode squeezed state with squeezing parameter r a b in the form 
e tanhr a( , _ g tanh r a tanh r b no ma ^ er w h a t result of the Bell measurement on beam 

2,3 is obtained [50, 59]. 

The CVQT result above is the ensemble outcome of the transferred state 
averaged over all possible measurement outcome at Alice's side, i.e., all pos- 
sible values of A and S. One can obtain the single-shot result through us- 
ing the Shrodinger picture. This can be done in the position-momentum 
representation[54], the coherent-state representation [55] and so on. A very 
useful single-shot result is given by Hoffman and coauthors in Schrodinger 
picture[53]. There, it is found that if Alice obtains her measurement outcome 
A, X, after Bob takes the displacement accordingly, the state transferred to 
Bob's side can be described by the so-called transfer operator T: 



where \ip)tei is the outcome state with Bob after the CVQT, |^ ) is the initial 
unknown state at Alice's side and 



tel — 



T(A,E)|^o) 



(127) 



f(A,S) 



1 — tanh r ~ 




7T 



and -D(A, S) = exp(— iAp + iT,x) as defined by Eq.(35). Besides these, there 
are also results about the CVQT in phase-number space[60,61,62] 
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2.2.3 Teleportation fidelity. 



As has been shown, if the squeezing parameter r of the pre-shared two-mode 
squeezed state is finite, there is always noise in the outcome state. An in- 
teresting question is whether we can obtain non-trivial outcome using finitely 
squeezed states only. The answer is positive if the initial unknown state is lim- 
ited to an unknown coherent state only. If there is no pre-shared entanglement 
resource, Alice and Bob may do the task trivially: Alice uses an optimized 
measurement to detect the state and then send her outcome to Bob through a 
classical channel. In this way, the fidelity of the outcome state and the initial 
unknown state cannot exceed 1/2. However, as shown below, in the CVQT 
with pre-shared two-mode squeezed states, the fidelity of outcome state and 
the initial unknown state is always larger than 1/2 provided that the squeezing 
factor is larger than 0. 

If the initial unknown state is a coherent state of \a = u + iv) = V(a)\0), the 
characteristic function given in Eq. (126) is for a displaced thermal state: 

Ptel = V{a) Pth {(3)V\a) (129) 

where pth((3) = (1 — e~P)e~ f3a]a is a thermal state and e~@ = d^ps? , which is 
a direct consequence of Eq. (72) and Eq. (73). The teleportation fidelity is 

F = (0\V\a)V(a)p th (a)V\a)V(a)\0) = (0\p th (r)\0) (130) 

which is simply 

F = l - e '" = T^-r- ( 131 ) 

1 + e 2r 

This result is independent of the parameters u, v. This is to say, all coherent 
states can be teleported with the same fidelity. The fidelity is larger than 
1/2 [63] provided that r > 0. Since no classical scheme can teleport an unknown 
coherent state with the fidelity larger than 1/2 [63], the result shows that the 
CVQT scheme can produce a non-classical result in teleporting an unknown 
coherent state given any small squeezing for the pre-shared two-mode squeezed 
state. 



2.3 Experiment 



There are 3 major steps in quantum teleportation: 1) Sharing quantum en- 
tanglment. The two-mode squeezed state can be regarded as the pre-shared 
entanglement if the two modes here are spartially separated. 2) The Bell mea- 
surement. This requires to simultaneously measure the quantity of x\ — X2 and 
pi +p2- This can be done by the homodyne detection. 3) The appropriate dis- 
placement operation dependent on the Bell measurement outcome. One can 
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Entanglement source 

Fig. 7. Experimental set-up for the quantum teleportation with Gaussian states. 
B: 50:50 beam splitter, m : mirror. Mx, Mp: displacement operation. LO: local 
oscillator. Beam 1 is the income unknown coherent light which is to be teleported. 
Beams il, i2 are two single- mode squeezed states. Beam 2,3 are two-mode squeezed 
state which is used as the entanglement source. Beam 4 is the outcome state which 
is produced by taking appropriate displacements to beam 3. 

see details in the figure 7. The first teleportation experiment with two-mode 
squeezed states is done in 1998 [64]. In the experiment [64], they have teleported 
an unknown coherent state with intensity changing in a large range. The aver- 
aged fidelity of the outcome state and the input unknown state is around 0.58. 
On the other hand, no classical method can reconstruct an unknown coherent 
state with a fidelity larger than 1/2 [63]. 

To keep the optical coherence, Alice and Bob must share the same local oscil- 
lator or be phase locked to one strong reference coherent light. The two mode 
squeezed states must also be phase locked to the local oscillator. Details of 
the coherence and the validity have been discussed in [65, 66] . According to 
Ref . [66] , the validity of existing experiment can be explained in this way: The 
protocol requires Alice and Bob share the same reference light. This can be 
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regarded as the classical communication for the calibration of measurement 
basis. Given the shared reference light and the fact that all those two-mode 
squeezed states are phase-locked to the reference light, the quantum coher- 
ence has been kept very well, it is something like multi-mode fields with same 
phase. Here, since they can only use finitely squeezed states, the teleportation 
fidelity is limitted. It is then interesting to ask the fidelity criterion for a good 
quantum teleportation with 2-mode squeezed states. There are several differ- 
ent viewpoints. A necessary condition for the a non-classical teleportation of 
an unknown coherent state is 

F av > \ (132) 

and F av is the teleportation fidelity averaged over all coherent states. This 
condition is required since otherwise one can make it without entanglement 
resource [63]. Another viewpoint [67] sets the necessary condition to be 

F av > 2/3 (133) 

since one may clone an arbitrary coherent state with a fidelity 2/3 [68]. Besides 
these, there are also other criteria[63,69]. Among all the existing experimental 
results of teleporting unknown coherent states[64,70,71], the highest average 
fidelity achieved is around 0.64. 

2.4 Dense coding with two-mode squeezed states 

In the two-level-state case, one may implement quantum dense-coding using 
the pre-shared EPR states. In such a way, he is able to realize two-bit classical 
communication through sending one qubit only. The role of quantum entan- 
glement and the advantage to the simple qubit-sending is clear: if they don't 
pre-share an EPR pair, one qubit can only carry one bit classical information. 

Similar results also exist in CV state case [72,73]. Here they need to pre-share 
a two-mode squeezed state. Alice takes an arbitrary displacement, Di(A, E) 
to her beam and then sends her beam to Bob. By a Bell measurement X\ — x 2 
and pi + p2, Bob obtains information of two parameters, A and S. In the 
case of infinite squeezing of their pre-shared state, Bob can obtain the two 
parameters exactly. However, we need to know the result in the case they 
only pre-share a finitely squeezed two-mode squeezed state. And we need to 
study the advantage to the case of simply sending a light-beam with certain 
common constraint, e.g., the same averaged photon number of the states. After 
calculation [73], it is found that the channel capacity of a two-mode squeezed 
state can be larger than that of a coherent state or a single-mode squeezed 
state. If they use very bright light (i.e., the average photon-number of the state 
is very large), the channel capacity of a two- mode squeezed state is nearly 2 
times of that of a coherent state or a single mode squeezed state. Explicitly, 
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the channel capacity of a coherent state and that of a two-mode squeezed 
state can be found in, e.g., [73,50]. We shall present the details in section 6.4. 
Experimental works on dense coding with two-mode squeezed states have also 
been done [74]. 

2.5 Quantum error correction codes 

The purpose of a quantum error correction code (QECC) is to process quan- 
tum information robustly in the presence of noise. 

Let's first consider a simple example in classical communication through a 
noisy channel. Each time we want to transmit one bit information which is 
either or 1. Since the channel is noisy, it flips the transmitted bit with 
probability p. This is to say, sometimes is changed into 1 and 1 is changed 
into during the transmission. The channel error rate here is p. However, we 
can decrease the error rate by using error correction code of the following: 



After the transmission, we recover the bit value of each code by the majority 
rule. In such a way, the error rate is decreased to 3p 2 (l —p) +p 3 . If the channel 
noise (p value) is small, the final error rate drops drastically. 

In the quantum information processing, there are something similar to this, 
but there are also something different. We can still use the same majority 
rule to correct bit-flip errors, but the initial state is in general an unknown 
linear superposition of |0), |1), the trivial repetition code doesn't work and 
quantum entanglement has to be involved. Also, we need to add something 
else to correct phase-flip errors. 

Say, in general, we want to protect an unknown state of the form 
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A bit-flip error changes the state into 



<7 6 |V>u) = a|l) + /3|0). 



(136) 



A phase-flip error changes the state into 



<7phk,) = a|0)-/3|l). 



(137) 



A simple quantum code of 



|0) ® |00) -> |000); |1) <8> |00) 



111) 



(138) 
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can decrease the bit-flip errors. Using such a code, any unknown state \ip u ) = 
a\Q) + j3\l) is encoded by a|000) + /3| 111) , which is normally an entangled 
state. This code can not remove phase-flip errors. Say, the channel noise can 
also change the state into a\0) — /3\1). To correct both types of errors, we can 
use a more complete QECC[75,76,77,78,79,80]. For simplicity, we demonstrate 
the main idea here with Shor's 9-qubit code [75]. 

Given any unknown two-level quantum state of equation (136), we shall first 
encode it with the 3-qubit phase-flip code, i.e., |0) — > |000) and |1) — > |111), 
and 

|0> = H\0) = -L(|0> + |1»; |1> = H\1} = -L(|0) - |1». (139) 

Here H is the Hadamard transform. We shall then encode each qubit again 
by eq.(138) against the bit-flip errors. In such a way we have a 9-bit code of 
the following: 



^ _ (|ooo) + |m))(|ooo) + |m))(|ooo) + |iii)) 
1 ; ~" 1 )ec 2V2 

Hv^m (|000> — |111»(|000> — |111»(|000> — 

After sending out the quantum code a|0) ec + /3|l) ec , if there is at most one bit- 
flip error and at most one phase-flip error, we can always detect the positions 
of flip precisely and recover the original code. Consider the 3 qubits in the 
first bracket. We first measure the parity of qubit 1 and 2 and obtain z 1(S2 , 
and then measure the parity of qubit 1 and 3 and obtain 2193. If both of them 
are then there is no bit-flip error. If both of them are 1, then qubit 1 must 
have been flipped and we flip it back. Similarly, zi e2 = 0, zi e3 = 1 means 
qubit 3 is wrong and the opposite result means qubit 2 is wrong. Such type 
of parity measurement does not destroy the code state itself. After we take 
such type of parity check to all 3 blocks, we can locate and correct the only 
bit-flip error, if there is one. We can also correct any phase-flip error. Suppose 
there is only one phase flip. In each block, if any qubit is phase flipped, the 
block state is changed from ^(|000) ± 1 1 1 1> ) into ^(|000) =F |111>). We can 
take another type of syndrome measurement by comparing the "phase" parity 
values of different blocks. Say, ^=(|000)±|111)) corresponds to the phase value 
0, 1, respectively. We can first measure the phase parity of block 1,2 and then 
measure that of block 1,3 and we can determine the phase flipped block if 
there is at most one block that is phase flipped. Therefore, if there is not more 
than one wrong qubit, we can always recover it to the perfect code and the 
original quantum state is protected perfectly. 

In making the 9-qubit code, we have used one important fact: to correct the 
phase flip error, we need first do a basis transformation and then construct the 
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code in the conjugate basis, i.e., from basis (|0), |1)} to {|0), |1)}. The similar 
idea can also be used to construct the error-correction code for an unknown 
continuous variable state[81]. Here we also have two conjugate basis, {\x)} and 
{\x)} which we shall call position basis and momentum basis, respectively. To 
use the idea of 9-bit code for the two level case, we need the relationship 
between state \x) and state \x). In the two level case, the two conjugated 
bases are connected by Hadamard transform. In the CVQT case, we have the 
fact that 

\x) = H c \x) = 4= / e 2lxy \y)dy. (141) 

where we have used the notation \x) for a momentum eigenstate with the value 
of the momentum being x, i.e., \x) = \p = x). 

Analogously to the 2-level QECC case, we can now use the following code for 
any state in position space 

1 f 

\Xencode) = J e 2lX{Vl \y ± ? y ± ? \y % y 2 ) y 3 ? ch/ld^d^. 

(142) 

It can be easily examined that any displacement error or phase error can be de- 
tected and corrected, if there is at most one displacement or phase error in the 
9 "qubits" . It has been shown that such a 9-qubit QECC can be implemented 
with linear optics and squeezed lights [81]. 

More generally, suppose q is any possible channel action. The sufficient and 
necessary condition for quantum error correction is[78,79] 

( X encode\^i^j\ X encode) = 8(x — x)Xij. (143) 

and Xij is a complex number independent of encoded states. It has been shown 
that similar to the case of 2-level states, an effective QECC code for the 
continuous variable states can be constructed by fewer qubits, e.g., only 7 
qubits of 5 qubits [82,83]. 

In the above, we have assumed the condition that there is at most one dis- 
placement error or phase-shift error in the code. However, a continuous vari- 
able state will always have some small errors. That is to say, it is impractical 
to request that only one mode in the quantum code has errors. This will limit 
the application of the above continuous variable QECC in practice. To avoid 
this difficulty, one can also use Gaussian states to encode a discrete-level state 
for error correction [84]. We can construct an encoded two-level quantum state 
based on the properties of the following operators 



S x = e 2 ^; S p = e" 2 ^ (144) 
It can be easily examined that these two operators commute and there are 
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two common eigenstates: 



|0) oc V] \x = 2s^fn) oc V] |p = s^/^l)■, 

— oo — oo 

oo oo 

|1) oc 2 |x = (2s + l)v^) oc X^(-!) S b = s vM- (145) 

— oo — oo 

This code can protect an unknown state against errors that induce shifts in 
the value of x and p. Any unknown state of the type 

$) = a\0)+P\l), (146) 

is an eigenstate of operator S x and also an eigenstate of S p . Therefore, it does 
not destroy the state if we measure both values of x modulo ypii and p modulo 
s/tt. After the measurements, we can correct small shift errors by a translation 
operation to displace x and p to their nearest integer multiples of y/ir. If the 
error induced shifts of both x and p are less than yf~K/2, the initial encoded 
state can be restored perfectly. 

The encoded state here is a linear superposition of infinitely squeezed states 
in q and p. Now we consider the practical case that we only have a finitely 
squeezed states. Suppose we encode state |0) by 



oo 

■\2 /A2 



(x-Wi) 2 /A2 



/ A \ 1/4 « uvj 

|0> ~ (l) J dx\x)e-^ A > 2 x £ 

dp\p)e-^ p2 x £ e -!(p-Vi) 2 /Ai. ( 147) 

If A x and A p are small, then in principle these shifts can be corrected with 
high probability. In the special case that A x = A p = A, it can be calculated 
that the probability of uncorrected error caused by A is bounded by [84]: 

2A 

Pe<—exp(-7r/4A 2 ). (148) 

Obviously, we can also concatenate a shift-resistant code with many Gaussian 
states. 



2.6 Gaussian cloning transformation 



It has been shown [4 7] that the perfect quantum cloning machine does not exist 
because it violates the linear superposition principle in quantum mechanics. 
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Say, given an arbitrary state map Co satisfying the following condition 
does not exist: 

Q>(hA» = hAM. (149) 

The idea for the proof is simple. Consider the 2-level system. If Co exists, it 
must satisfy 

Cb(|0» = |00>; G,(|l» = |ll). (150) 
The linear superposition principle requires the same map to satisfy 

C (|+» = ^(|00) + |11». (151) 

However, if Co is a perfect cloning map, we request the conflicting result of 
Co(|+)) = I + +)• This shows that Co cannot clone an arbitrary unknown 
2-level state perfectly. If it clones |0) and |1) perfectly, it cannot clone state 
|+) perfectly. 

However, the quantum approximate cloning machines do exist [85]. We label 
the input unknown state by subscript 1 and the two ancilla by 2 and 3. The 
approximate cloning process can be mathematically described in: 

C(|V)i|0) 2 |0) 3 ) = |V')i23- (152) 

We then discard qubit 3 and we want to have large values for the following 
quantities (the cloning fidelity) :{if)\pi\if)} and (-0 1 IV 7 ) an d Pi, Pi are states of 
qubit 1, 2 respectively, after tracing out qubit 3 of the output state |^')i23- 
This is the so called 1 — ► 2 cloning. The same concept can be extended to 
M — > N cloning. Various types of cloning machine have been investigated 
for 2-level states[85], or even for discrete d— level states[86]. The problem has 
then been investigated with the continuous variable states [68] by Cerf, Ipe 
and Rottenberg (CIR). In particular, a type of Gaussian cloning machine is 
constructed explicitly. CIR considered the displacement invariant Gaussian 
cloning machine. Say, if two input states are identical up to a displacement 
D(x',p') = e~ lxp e lpx as defined by Eq.(35), their respective copies should be 
identical up to the same displacement. Mathematically, the 1 — ► 2 cloning 
machine C satisfies 



C 



D(x' ,p')\il))(ip\D\x ,p') \ = D(x',pT 2 C[\^)(^\}D\x',p'f 2 - (153) 



We now consider 3 modes. Mode 1 is for the unknown input state denoted by 
Mode 2 and 3 are ancilla. After the cloning map, we discard mode 3 and 
mode 1,2 are the outcome of 1 — » 2 cloning. Without loss of any generality, 
we set the initial state of mode 2 and 3 to be 

p poo 

Ix) 2 ,3 = / / f(x,p)\V(x,-p)) 2 ,3dxdp, (154) 
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where f(x,p) is an arbitrary complex amplitude function and 



\*(x,p)) = -= / e™\y)\y + x)dy. (155) 

The cloning transformation is 

U = q-^-^pi e -ixi(p2+p 3 ) (156) 

This is actually the analogy of qubit cloning transformation [85]. After applying 
U to the state |^)i|x)2,3, we obtain the following 3-mode state: 

f(x,p)D(x,p)\i/;)i\^(x, -p)) 2 , 3 dxdp, (157) 

where mode 1 and mode 2 are taken as the two output states of the doner. 
This class of cloning machines are parameterized by f(x,p). If we choose 
f(x,p) = e~( x +p ^/y 7 ^, the doner will provide two identical copies. For an 
arbitrary input state the noise of each output mode is a 2 = 1/2 and the 
state is 

Pl =P2 = - f r e- x2 - p2 D{x,p)\ij)(ilj\D\x,p)dxdp. (158) 

7T J J~oo 

In particular, if the input state is the coherent state = \a), the cloning 
fidelity is 

1 2 

(a\pi\a) = {a\pi\a) = ^ 2 = -. (159) 

This cloning fidelity is independent of a. It can be regarded as the Gaussian- 
state analogy of the qubit doner. Note that the cloning noise here is larger 
than that of qubit doner. The result can also be extended to the 7V — > M 
cloning[87], in analogy with that of a qubit-cloner[88]. The cloning transfor- 
mation here has been proven to be the one that offers the largest fidelity in 
principle[68,88,89] because cloning transformation can not help one to estimate 
an unknown state better than the known result of optimized measurement. 
The result can be extended to clone a squeezed state[68]. Optical implementa- 
tions have been also proposed[90]. One can also do telecloning with quantum 
entanglement[50,91]. An excellent review about quantum cloning has been 
presented very recently [89]. 



2. 7 Entanglement-based quantum tasks with weak Gaussian states: post- selection 
vs non-post-selection 



Most of the important results of entanglement-based quantum information 
for two-level systems have been experimentally demonstrated, e.g. [12,92]. The 
heart of the experimental demonstration is the generation and manipulation 
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of quantum entanglement. Photon polarization is the most natural choice for 
the entanglement space because it is easy to manipulate. However, there is no 
simple way to generate the perfect EPR state deterministically in polarization 
space. In the existing experiments, probabilistic EPR states are generated 
by spontaneous parametric down conversion (SPDC). Actually, the entangled 
state generated by the SPDC process is a type of mulit-mode weak Gaussian 
state in the form 



where the vacuum state |0) is the abbreviation of two- mode vacuum, the sub- 
scripts of each creation operators indicate the polarization and (3 is a complex 
number with \ f}\ being very small. Normally, we only need to consider the one- 
pair state from the Taylor expansion given that \f3\ is very small. However, in 
the existing experiments, the photon detector normally does not distinguish 
photon numbers exactly, one can only observe whether it clicks. If the inci- 
dent light beams contains one or more than one photon, the detector may 
click. Given this fact, the higher order terms in the weak Gaussian states take 
a non-trivial role and in many experiments one may only choose the exper- 
imental results by post selection. However, by carefully designing, in some 
cases one can still obtain the non-post-selection results. In this subsection, 
we shall first demonstrate how the higher order terms in the weak Gaussian 
states from SPDC process can have non-trivial effects and what is the so called 
post-selection result by the example of quantum teleportation. We then show 
how to convert the post-selection result to non-post-selection result by two 
examples, quantum teleportation and quantum entanglement concentration. 

2. 7. 1 Post-selection 

Consider the set-up of the first teleportation quantum experiment in figure 
8. In the ideal case, one EPR pair is generated at each side of the nonlinear 
crystal, i.e., beam 1, 2 is a pair and beam 3, 4 is another pair. After the 
polarization of beam 2 is measured, the polarization of beam 1 is known and 
therefore an arbitrary polarization can be prepared on beam 1 by rotation. 
(The rotation is not drawn in the figure.) Beam 1 and 3 are then sent to a 
beam-splitter for an (incomplete) Bell measurement. As shown already, if there 
is one and only one outcome photon on each side of the beam-splitter, beam 
1 and 3 have been collapsed to the anti-symmetric EPR state and the original 
polarization state of beam 1 has been teleported into the remote photon in 
beam 4, up to a fixed unitary rotation. If detector D2 could distinguish the one- 
photon state and the two-photon state, the set-up can be used as a teleporter 
without post-selection. However, since the detectors there cannot distinguish 
one photon and two photons, the result becomes more complicated [93]. What 
we can observe is whether the detector clicks or not. It is also possible that 




(160) 
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Fig. 8. The set-up of the first teleportation experiment in polarization space. C: 
nonlinear crystal, P: pump, BS: 50:50 beamsplitter, M: mirror, Di: photon detector. 

initially beam 1, 2 contain two pairs while beam 3, 4 are vacuum. Suppose D2, 
D3 and Dl all click. There is considerable possibility that beam 4 is actually 
vacuum. That is to say, whenever we have observed the three-fold coincident 
event of Dl, D2 and D3, we are actually not sure whether the teleportation 
has been done successfully, since D2 doesn't distinguish one photon or two 
photons. To ensure a successful teleportation, we need to also observe beam 
4. But once beam 4 is observed, the state is destroyed. We call such type of 
results as post-selection-result because once we are sure of a successful result, 
the outcome state is destroyed already. Obviously, if there is a sophisticated 
photon detector which distinguishes one-photon and two-photon beams, the 
issue will be resolved[?]. Or, we can use strong entanglement in the position- 
momentum space as shown earlier in this section, because the strong two-mode 
squeezed state is deterministically entangled in position-momentum space. 
Actually, this non-post-selection property is an important advantage of bright 
Gaussian states for QIP tasks. Interestingly, even with weak Gaussian light, 
the entanglement-based experiments for two-level systems can be done without 
post-selection in some cases. 



2.7.2 Non-post-selection teleportation 

One can still use the same set-up, but the pump light after reflected back 
by the mirror in figure 8 is weakened [94, 95]. For example, we can weaken 
the reflected pump light to 1/20 of its original intensity. In such a way, once 
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the event of 3-fold clicking of D1,D2, and D3 is observed, the possibility of 
a successful teleportation is more than 20 times larger than the posibility of 
nothing on beam 4 [95]. Mathematically, the initial Gaussian state is 



|SPDC) = exp 



2g( a m a 2H + a lv a 2V 



cxp 



|0). (161) 



Doing Taylor expansion to the order of /3 2 , we have the following approximate 
4-photon state 



|SPDC 4 ) « ^{a\ H a\ H + a{ v a\ v ) 2 \0) + ^|$ + ) 12 ® |*+) M 

+f(4 H al H + al v al v ) 2 \0) (162) 

and \<p + )ij is a perfect EPR pair state for beam i and j. Since we request 
detector D2 click, the state of the third term is excluded. Once the event 
of 3-fold clicking of Dl, D2 and D3 is observed, the initial state of \SPDC) 
could have been collapsed to either the first term or the second term in the 
above formula. But, the prior probability for the second term is 20 times larger 
than that of the first term. Therefore, with very large possibility the initial 
state contains one pair at each side of the crystal. The experiment has been 
done sucessfully[95]. Here the main technique used is to decrease the prior 
probability of those unwanted terms. The similar technique can also be used 
for non-post-selection entanglement swapping with SPDC state, in the two- 
level space of vacuum and one-photon [96]. However, weakening the probability 
of unwanted term is not the only way to remove the post-selection condition. 
For different tasks we have different ways. 



2.7.3 Non-post-selection entanglement concentration 
The following raw state 

\r, <p) = -^—^{\HH) + re*\W)) <8> (\HH) + re i4> \VV)) (163) 

can be probabilistically distilled into the maximally entangled state without 
post select ion [9 7], even though the normal yes-no single photon detectors are 
used. Note that in Eq.(163) , both r and <p are unknown parameters. The ex- 
isting experiments have demonstrated the post-selection results[98,99]. In par- 
ticular, the special case r = 1 is the one treated in the recent experiment [98]. 
Consider the schematic diagram, figure 9. (Earlier, a similar scheme was given 
in[100,101] for another experiment.) The scheme requires the two fold coin- 
cidence event as the indication that the maximally entangled state has been 
produced on the outcome beams 2', 3', i.e. whenever both detectors D x and D w 
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click, the two outcome beams, beam 2' and beam 3' must be in the maximally 
entangled state: 

|$ + >2', 3 ' = -j=(\H)2,\H) 3 ,\ + V) 2 ,\V) 3 ,). (164) 

Now we show the mathematical details for the claim above. The polarizing 
beam-splitters transmit the horizontally polarized photons and reflect the ver- 
tically polarized photons. For clarity, we use the Schrodinger picture. And we 
assume that the non-trivial time evolutions to the light beams only take place 
while the light pass through the optical device. 

Consider Fig. 9. Suppose initially two remote parties Alice and Bob share two 
pairs of non-maximally entangled photons as defined by Eq.(163), denoted by 
photon pair 1,2 and photon 3,4 respectively. The half wave plate HWP1 here 
is to change the polarization between the horizontal and the vertical. After 
photon 3 and 4 each pass through HWP1, the state is evolved to: 

-J-^(\HH} 12 + re^\VV} 12 ) ® (\VV) 34 + re^\HH} 34 ). (165) 

Furthermore, after the beams pass through the two horizontal polarizing beam- 
splitters( denoted by PBS1), with perfect synchronization, the state is 

|x'> = T ^(|^>v|^>2' + re^|y)3^)40®(l^>i|^)2 + re^|if) 3 | J H")4). (166) 
1 + r z 

This can be recast to the summation of three orthogonal terms: 

\^) = t^(\A) + \B) + \C)), (167) 

where 

\A) = re t4, (\H) v \H) 2 ,\H) v \H) A , + \V) V \V) 2 ,\V) 3 ,\V) AI )- (168) 



\B) = \H) v \V)v\H) 2 ,\V) 2l] (169) 

\C)=r 2 e 2i *\H) 3 ,\V) y \H) A ,\V) 4 , (170) 

Obviously, term \B) means that there is no photon in beam 4' therefore this 
term never cause the requested two-fold coincident event and hence it is ruled 
out. Similarly, term \C) can also de disregarded and only term \A) should be 
considered. 

After the beams pass through HWP2, state \A) is evolved to 

|$ + )l"4"| $+ )2'3' + |* + )l»4»| $ ~)2'3' (171) 
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Fig. 9. Non-post-selection quantum entanglement concentration by practically ex- 
isting device of linear optics. The two-fold coincident event of both detector D x and 
detector D w being clicked indicates that a maximally entangled state is produced on 
beam 2' and 3'. PBS: polarizing beam-splitter. Here HWPl rotates the polarization 
by it/2, HWP2 rotates the polarization by it/4. 



where |$±) y = ^(\H)i\H) j ± \V),\V) 3 and |¥±) y = j 5 (\H) i \V) j ± \V),\H) y 
After pass through the two PBS2 in the figure, \A) is evolved to state 



x)\w)\^> + ) 2 ^ + \y)\z)\<S> + ) 2 > w + {\x)\z) + \y)\w))\Q-)w (172) 



where \s) denote the state of one photon in beam s, s can be x,y,z or w. 
From the above formula we can see that only the first term will cause the 
requested two- fold coincident event. This term indicates a maximally event- 
ready entangle state between beam 2' and 3', i.e. -^(\H) 2 '\H) 3 i + \V) 2 >\V)y). 
Note that the result here is independent of the parameters r, <fi. 

To really produce the event-ready entanglement through the concentration 
scheme here one need the deterministic supply of the requested raw states. 
This is rather challenging a task. However, as it has been shown [9 7], even 
without such a deterministic supply, one can still experimentally demonstrate 
that the scheme can produce the event-ready maximally entangled pair if the 
requested deterministic supply of raw state is offered. 

Remark: The non-post-selection scheme for QIP is not limitted to teleportation 
and entanglement concentration, e.g., there are non-post-selection schemes for 
the tsak of state Gaussification[102,103]. 
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3 Quantum cryptography with weak coherent light 

3. 1 Introduction 



Security has been an important issue for the communication over the networks 
these years. The internet traffic has been growing rapidly to include important 
information, such as a huge amount of orders for exchange markets or the deci- 
sion of a government. Modern economies and societies rely on the availability, 
confidentiality and integrity of critical fiber optic network infrastructures to 
function properly and efficiently Recent deregulation improves the accessi- 
bility to the networks and encourages new services. It also results in a side 
effect that increases vulnerability against the illegal tapping to steal confi- 
dential and commercially sensitive data. Encryption, usually public-key and 
secret-key cryptosystems, is one of the best means to keep such confidential 
from the malicious eavesdroppers. However, those cryptosystem only provides 
so called computational security, relies on the fact decryption requires imprac- 
tically long time for the current computers. The encryption systems may be 
broken with the enormous calculation or the sudden appearance of the poly- 
nomial algorithm, even before a quantum computer runs Shor's algorithm to 
solves the RSA cryptosystem. Also, some of the widely believed secure classical 
cryptographic system have now proven to be indecure[104] 

It has been proven that the secret key cryptographic systems are secure as 
long as the key is not used more than once (one-time-pad or Vernum cipher.) 
This method needs the unrealistically vast pool of the encryption key, thus in 
practice, one finite key is repeating, causing the debilitation of the conceal- 
ment. Quantum key distribution (QKD) provides a protocol where the sender 
(Alice) and the legitimate receiver (Bob) can share the same bit sequence suc- 
cessively without leaking any secret key information guaranteed by the law of 
quantum mechanics. This unconditional security, which cannot be achieved by 
conventional cryptography, clearly shows the advantage of the quantum infor- 
mation technology. Unlike other quantum information protocols proposed so 
far, QKD can be implemented with current photonic technology. Therefore, 
number of papers have reported the QKD transmission experiments. 

In the following, we will consider a QKD protocol, so called BB84 (Bennett 
and Brassard 1984) [3] in particular. BB84 protocol has been proved to be un- 
conditionally secure, if implemented with a perfect single photon source. It 
is, however, still difficult to provide a single photon source with a practically 
meaningful specification. Almost all the experiments towards practical imple- 
mentation employ weak coherent light from semiconductor lasers instead. We 
will first briefly review the theoretical backgrounds of the unconditional secu- 
rity in BB84 protocol. Then we will discuss practical implementations of the 
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protocol. Possible attacks to the QKD system using a weak coherent light will 
be examined. We will focus on the basic issues and the recent experimental 
progress. Readers who are interested in the detail of QKD should refer the 
review by Gisin et al. [13], where they would find good introduction of the 
QKD protocol and state of art at 2001. 



3.2 QKD in practice 



3.2.1 Requirement for single photon detectors 

In QKD systems with a single photon or a weak coherent light, we need to send 
and receive signals encoded in single photon states. One of the most important 
device in QKD transmission is single photon detector (SPD,) which limits both 
the transmission distance and the transmission rate. The SPDs should show 
high detection efficiency, low dark counts, and short response time. The ratio 
of the detection efficiency n to the dark count probability P d determines the 
error rate e#, as 



lS(l-v)r) + P t 



2 Pdet 
1 S(l-v)+P d / V 

2S{l-P d ) + P d /n' 



(173) 



where v is the visibility of the interferometer, and Pdet represents the detec- 
tion probability per pulse. Pdet is related to the probability S that at least 
one photon arrives at the detector by 

Pdet = Sn + P d - S V P d . (174) 

The probability S is a function of the loss in the transmission line and the 
receiver. The photon loss in a L km-long- fiber is given by aL [dBj.When we 
assume the receiver loss is (3 [dB], S is given by 

S = kt^^)/ 10 (175) 

for a single photon source, and 

S = 1 - exp [-^lO-^+^Z 10 ] (176) 

for a coherent photon source with the average photon number of fi. The error 
rate (173) is given by the half of the inverse of signal-to- noise ratio S/N (noise 
will give the error with the probability of 1/2.) Eq.(173) shows that the ratio 
P d /n is a figure of merit of a SPD that determines the error probability, because 
P d and 1 — v are small. Secure QKD can be achieved only when the error rate 
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is kept lower than a threshold for security. The threshold varies according to 
the assumptions on the method of Eve's attack and error correction. Typical 
threshold value is around 11 %[105,106]. Then the ratio P d /r] should be smaller 
than 10~ 3 for 100 km fiber transmission in 1550 nm, where the commercial 
fibers take the lowest loss value (0.2 dB/km), even with an ideal single photon 
source. 

Response time of SPDs may limit the clock frequency of the system. SPDs 
cannot detect photons during the recovery time (typically several hundreds 
nanoseconds) after one detection event. Another effect (sometimes more se- 
rious) is the afterpulse, false photon detections caused by residual electrons 
created by the previous detections. We can not send a photon pulse during the 
period of large afterpulse probability. The afterpulse effect remains typically 
1 /is after the photon detection. This period may vary on the devices and the 
operating conditions. The afterpulse effect on error probability can be formu- 
lated as follows. We assume two detectors 1 and 2 to discriminate bit values 
and 1, respectively. The probabilities pi(t n ) that detector 1 fires and p2{t n ) 
that detector 2 fires are given by the bit value b(t n ) = {0, 1} at the n-th clock 
as 

n-l 

pi(t n ) =S m (t n ) + P d + f(tn-U)pi{ti) (177) 

i=— oo 

n-l 

P2(tn)=S V (l-q(t n )) + P d + ]T fiK-t^U) (178) 

i=— oo 

where the function 



q(t n ) = v(l- b{Q) + (1 - v)b{t n ) (179) 

defines the fraction that a photon enters the detector 1, and the memory 
function f{t n — ti) represents the afterpulse effect. A reasonable form of / 
might be f(t) = Aexp[— / yt], but here we assume 



/(*) 



A (0<t< t M ) 

1 " , (180) 

(t<0,t>t M ) 



for simplicity. The afterpulse probability A remains constant during M periods 
of the clock in this model. Then Eq. (178) can be solved for the asymptotic 
values. The error probability is given by 

e B = l^+^H + V ~ l l 2 AM *e B + '-AM, (181) 
l + 2P d /Sr ] l + 2P d /S V 2 ' K J 

if we neglect the events that both detectors fire simultaneously. Eq.(181) shows 
that the afterpulse effect increase the error probability by AM/2. For example, 
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typical values A = 10~ 3 and M = 100 increase the error probability by 5 %. 
The afterpulse effect can be reduced by neglecting the photon detection during 
the time < t < t^. 

Devices for single photon detection must have a multiplication process inside 
the device: single photon detectors should yield many carriers from one pho- 
ton, otherwise the amplifier noise will hide the signal. Avalanche photodiodes 
(APD) are widely used for the SPD, because of the high detection efficiency. 
A bias voltage higher than the break down is applied to the APDs to ob- 
tain large avalanche gain (order of 10 6 ). The bias voltage should be decreased 
below the break down voltage after photon detection to quench the break 
down. This operation mode is called Geiger mode. Several methods are given 
to quench the APDs. The simplest one is called passive quench to put a high 
resistance in series to the APD. The break down current induce voltage drop 
in the resistance. More sophisticated method is active quench to use a circuit 
to detect the break down and decrease the bias. Si- APDs provides good per- 
formance for visible photon detection. Commercially available SPD modules 
detect single photons with the efficiency of rj « 50%, while the dark count 
rate is kept at 100 counts/sec. However, the single photon detection in 1550 
nm, which is suitable for fiber transmission, is still a big issue for the ex- 
periment. The QKD experiments in 1550 nm have employed the SPDs using 
InGaAs/InP APDs as APDs with InGaAs absorption layer have sensitivity 
at this wavelength. However, the InGaAs/InP APDs in Geiger mode are suf- 
fered by large dark count probability and afterpulse, which cause errors in the 
qubit discrimination. The dark count probability and the afterpulse can be 
reduced by using gated-mode, where gate pulses combined with DC bias are 
applied to the APD. The reverse bias exceeds the break down voltage only in 
the short pulse duration. Though the gated-mode works well, the short pulses 
produce strong spikes on the transient signals. High threshold in the discrimi- 
nator is therefore necessary to avoid errors, at the cost of detection efficiency. 
High gate pulse voltage is also required to obtain large signal amplitude by 
increasing avalanche gain. Impedance matching helps to reduce the spikes to 
some extent [107]. Bethune and Risk have introduced a coaxial cable reflec- 
tion line to cancel the spikes[108]. A unique observation has been made by 
Yoshizawa, et al. that photon detection changes the shape of the charge out 
spike. This change was shown to be useful for high speed photon detection. 
Tomita and Nakamura[109] reported a much simpler method: canceling the 
spikes by taking the balanced output of the two APDs required for the qubit 
discrimination. We describe the detail of the balanced APD photon detector 
in the following. 

Figure 10 depicts the schematic of the SPD. Two APDs (Epitaxx EPM239BA) 
and load resisters were cooled to between — 133°C and — 60°C by an electric 
refrigerator. Short gate pulses of 2.5 V p-p and 750 ps duration were applied 
to the APDs after being combined with DC bias by Bias- Tees. The output 
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Fig. 10. Schematic of the photon detector. HJ and DISC stand for a hybrid junction, 
and discriminators. 
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Fig. 11. Cancellation of the transient spike. Thin solid: APD 1, Dots: APD 2, Thick 
solid: the differential output of the APD 1 and the APD 2. 

signals from the APDs were subtracted by a 180° hybrid junction of 2-2000 
MHz bandwidth. The differential signal was amplified and discriminated by 
two discriminators. Since the spikes were the common mode input for the 180° 
hybrid junction, they would not appear at the output. The APD 1 provided 
negative signal pulses at the output, while the APD 2 provided positive pulses. 
One can determine which APD detects a photon from the sign of the output 
signals. Figure 11 shows the output signal of the amplifier without photon 
input. Almost identical I-V characteristics of the APDs enabled us to obtain 
a good suppression of the spikes. The lowest dark count probability of 7xl0~ 7 
per pulse with detection efficiency of 11 % at -96 °C has been observed. The 
ratio Pd/v was as small as 6xl0 -6 , which corresponds to 270 km QKD trans- 
mission with an ideal photon source. The detection efficiency and the dark 
count probability are increasing functions of the bias. The maximum value of 
the detection efficiency is obtained when the DC bias is set to the break down 
voltage. Larger values of the maximum detection efficiency were observed at 
higher temperatures: the detection efficiency of 20 % at -60 °C with the dark 
count probability of 3xl0~ 5 per pulse. Afterpulse probability was measured 
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by applying two successive gate pulses to the APDs. Afterpulse is prominent 
at low temperatures. Afterpulse probability remained about 10~ 4 for the 1 
/j,s pulse interval at the temperatures higher than -96 °C. This corresponds 
to 1CT 5 error probability (per pulse) for 10 % detection efficiency Based on 
the observation on the dark count probability and the afterpulse probability, 
we conclude that the optimal operation temperature for the present APDs is 
around -96 °C. The obtained afterpulse effect was shorter than the previous 
reports. This is probably due to the decrease of the gate pulse voltage. This is 
another advantage of the present SPDs. Recently, the dark count probability 
has been reduced to 2xlCT 7 per pulse at the detection efficiency of 10 %[110]. 
The S/N, or the ratio Pd/f] is improved about 50 times (17 dB) as much as 
the values previously reported. 



3.2.2 Implementation of BB84 protocol 

We first need to determine how to implement qubits to realize a protocol. 
Polarization is one of the straightforward way, because of the direct corre- 
spondence between the Bloch sphere for a spin-1/2 state and the Poincare 
sphere for the photon polarization state. The four states used in BB84 proto- 
col are given by 
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where \H), \V), \F), and IS*) denote the horizontal, vertical, 45°, and 135° 
polarized states, respectively. We can choose the polarization states arbitrarily 
as long as (0|1) = <0|T> = and |(0|0)| 2 = |(0|1)| 2 = |(1|0)| 2 = |(1|1)| 2 = 1/2. 
For example, the circular polarization states \L) and \R) will work; the BB84 
protocol can be implemented with two of the three basis sets , | V)}, 
{\F) , \ S)}, and {\L} , \R)}. As stated before, practical systems employ weak 
coherent light in place of a single photon. Polarization states of the coherent 
state light are given by 
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where the horizontally (vertically) polarized coherent state \at) H r V *, is expressed 
by the number states as 

2 00 n, n 

\ a ) H (V) = e 2 l^ZJ \ n )H(V) ( 184 ) 
n=0 U - 

The 45° polarized coherent state is reduced to a superposition of single photon 
states in the weak light limit (a <C 1): 

\F) coh « \vac) + ^(\H) + \V)) + 0(a 2 ) (185) 

Similar expression holds for the 135° polarized coherent state. Therefore, the 
weak coherent states (183) can approximate the four single photon states 
(182), when we neglect the vacuum states by postselection. This observation 
rationalizes the use of weak coherent states in the QKD systems. 

The above polarization encoding is often employed in QKD systems for free- 
space transmission. However, the polarization encoding is not suitable for fiber 
transmission, because the polarization states fluctuate in fibers by the effects 
of environment: birefringence induced by stress, and polarization rotation by 
the geometric phase in twisted fibers. Nevertheless, it should be noted that 
the polarization coding may be still usable if we compensate the polarization 
changes after the transmission. This is due to the fact that the polarization 
fluctuation in the installed changes slow (in minutes or hours), and intermit- 
tent control with strong reference light will keep the polarization states. 

The alternate coding is phase coding. Suppose a Mach-Zehnder interferometer 
(MZI) as shown in Fig. 12(a). The amplitude of the photon is divided equally 
into the two arms of the interferometer (path P and path Q). Alice can prepare 
the four states for BB84 protocol by modulating the phase of the amplitude 
in one arm by one of the four values: <pA = {0°, 180°}, and {90°, 270°}. The 
modulation results in 



|0} = -^(|P> + |Q» 
|1>~(|P)-|Q» 

\0} = ^=(\P}+^\Q}) 

\l) = ^(\P)-i\Q)), (186) 

where the wavefunction \P) (\Q)) represents the state that a single photon 
exists in the path P (Q). The states given in Eq. (186) are equivalent to 
the states {\F) , \S) , \L) , |-R)}. Phase modulation in Bob's station refers to 
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Fig. 12. A Mach-Zehnder interferometer set-up for implementing BB84 protocol with 
phase coding, (a): Basic scheme (b): Scheme consists of two asymmetric Mach-Zehn- 
der interferometers and a single transmission channel (c) Plug and play system using 
a Faraday mirror for self-compensation 

the basis selection. Bob obtains the correct bit values, when the difference 
between the phase modulations satisfies 4>a — <Pb = 0°, or 180°. 

MZI shown in Fig. 12(a) is however impractical, because it requires two fibers. 
Besides the economical reasons, the interferometer is sensitive to disturbance, 
because the photons in the different paths experience the independent fluctu- 
ations. A time division interferometer, which requires only one common fiber 
for transmission as shown in Fig. 12(b), will be more stable. Alice's asymmetric 
Mach-Zehnder interferometer (AMZ) divide the amplitude into double pulse, 
where one component passed through the shorter arm, and the other through 
the longer arm. Modulation of the relative phase between the pulse component 
results in the four states (186). After passing Bob's AMZ, the pulse contains 
three components. The first component originates from the amplitude that 
passed through the shorter arms in both interferometers. The middle com- 
ponent results from the two contributions: the shorter arm in Alice and the 
longer arm in Bob, and vice versa. The last component originates from the 
longer arms in both. Only the middle component shows interference, and con- 
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tributes to the key transmission. Photon detection probabilities are 1/4, 1/2, 
and 1/4 for the first, middle, and last components. Therefore, the time divi- 
sion system loses a half of the transmitted photons. This time division phase 
coding was first implemented by Townsend et al [111] for QKD systems. They 
observed a clear interferometric fringe after the transmission in the fiber of 10 
km-30 km long. The time division QKD system requires precise control of the 
path length. The two interferometers of Alice and Bob should be identical to 
obtain a high visibility. The path difference should be kept within 3 % of the 
wavelength to maintain the visibility higher than 0.98. 

A simple method has been proposed to achieve stable interference without 
complicated active stabilization. This method, called 'Plug and Play' (P&P) [112], 
utilizes folded interferometer as shown in Fig. 12(c). Original proposal used 
three Faraday mirrors (FM)[113], but the simplified scheme works with one 
FM[114]. This scheme combines the time division and polarization division 
interference. The output of the laser is divided into two arms by beam splitter 
(BS). The one arm is set to be longer than the other. The outputs of the two 
arms are combined by polarization beam splitter (PBS) after the polarization 
rotation in one arm by 90°. The transmitted light is reflected by the FM and 
phase modulation is applied to one of the time divided components. The light 
is sent back to Bob after attenuation to the single photon level. PBS divides 
the light into the two arms. Since the polarization is rotated 90° by FM, the 
light component passed through the shorter arm in the outward transmission 
goes to the longer arm in the homeward transmission, and vice versa. The 
use of common AMZ guarantees the condition for the interference automati- 
cally. Moreover, the P&P scheme is robust to the disturbance during the fiber 
transmission. To see this, we examine the role of the FM in P&P systems. 
Since the reflected light propagates in the opposite direction, we need to be 
careful about the coordinate. Here we fix the direction of axes in the labora- 
tory. The effect of FM in linear polarization basis reads a x rotation. The effect 
of transmission line (fiber) on the polarization can be expressed by a unitary 
transform: 



respectively. The above unitary transform (187) is general, as long as we can 
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and the rotation on z axis 
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neglect depolarizing in the fiber. We can see that the total effect (not include 
global phase) of going- around the transmission line is just the transformation 
by the FM 

R z {26) R y {2 1 )R z {2(3) a x R z {2(3) R y {2 1 )R z {26) = a x . (190) 

Eq. (190) implies that the outward and homeward polarizations are orthog- 
onal, regardless of the disturbance at the transmission line and the initial 
polarization. This condition is essential for stable interference. Combination 
of an ordinary mirror and a quarter wave plate will rotate the polarization. 
However, this combination does not work for auto-compensation, because its 
effect is described by R y {n) ^ a x . Even with FMs, the autocompensation be- 
comes no longer perfect, if the transformation by the FM deviates from a x . 
Since the refractive index in materials depends on temperature, the rotation 
in FMs is no longer equal to 90° as sifting temperature. It has been shown 
the combination of a phase modulation and a polarization rotation in a loop 
mirror yields a x [115]. Temperature dependence can be easily compensated by 
changing apply voltage to the phase modulator, so that stable operation in 
a wide temperature range (from — 5°C to 75°C) has been obtained. It should 
be noted that we assume the disturbance in the homeward transmission is 
identical to the outward transmission. We see this assumption reasonable, 
considering the fact that the round trip time is shorter (about 1 /xs/km) than 
the time constant of the disturbance in the fiber (more than 1 s). 

3.2.3 Plug & Play System 

Most of the successful QKD transmission experiments have been based on so 
called Plug-and-Play (P&P) system, which contains autocompensation mech- 
anism to achieve good interference performance with ease[116]. In P&P sys- 
tems, the light source and the photon detectors are in the same side of the line; 
the pulses travel first from Bob to Alice, and then back to Bob. Back-scattered 
light will degrade the signal-to-noise ratio. The back-scattering is unavoidable 
due to non-uniformity in a fiber. The connections in practical fiber network 
will cause considerable reflection. Therefore, burst mode operation is necessary 
in practical P&P systems, where a storage line is installed in Alice's station, 
and the length of the pulse train is set to be smaller than the storage line. 
The backward light will never cross the bright light in the transmission line. 

Currently, two P&P systems have appeared on market[117,118]. QKD experi- 
ments on installed fibers have been also reported. One is the transmission over 
67 km done by the group of Geneva University [116]. They reported a success- 
ful key exchange at raw rate of 160 Hz with 5 % QBER through a 67.1 km 
fiber from Geneva to Lausanne installed under the lake, where the measured 
fiber loss was 14.4 dB. Average photon density was set 0.2 photons/pulse in 
this experiment. Recently, Hasegawa et al[119], have reported key exchange 



63 



over 64 km and 96 km fiber transmission test-bed (JGNII). The fiber loss in 64 
km single mode fiber was 13.29 dB. They could exchange key at 21.5 bps with 
4.7 % QBER for 64 km transmission and 8.2 bps with 9.9 % QBER for 96 km 
transmission, respectively. The clock frequency of the system was 1 MHz, and 
average photon number was 0.1 photons/pulse. The fiber cable in the test bed 
contained ten cores, so that they used one core for quantum communication 
and another core for clock distribution. 

So far, the transmission experiments were done in fairly stable environments, 
even in the installed fibers, the fibers were buried under the lake or well- 
maintained as a test-bed. In commercial fiber networks, which contain many 
connections and reflecting points, the loss and the back-scattering differ fiber 
to fiber. Access links for end-users sometimes use the fibers installed in the 
open-air. The fibers may experience mechanical vibration and temperature 
fluctuation. The system for quantum communications should be designed to 
be stable against the fluctuation of the environment. The QKD systems should 
have a clock synchronization system, which can trace the shift of fiber length 
due to thermal expansion and keep the optimum timing. A watch-dog sys- 
tem is also necessary to monitor key generation rate and error rate, and the 
transmission system should automatically re-set and calibrate itself on system 
errors. A QKD system fully equipped with the above functions has been devel- 
oped. A 'hands-free' transmission was achieved through a 16 km commercial 
fiber link installed on electric poles with the system for fourteen days with the 
final key rate of 13 kbps[120]. 



3.2.4 one-way transmission 

Although the P&P system works well for QKD systems using a weak pulse 
up to 100 km [110], extending the transmission distance will be difficult even 
if a lower noise SPD is developed. This is because backscattering noise in 
the fiber dominates the detector noise, which is intrinsic to the bidirectional 
autocompensating system. Although the use of storage line and burst photon 
trains would reduce the backscattering, this would also reduce the effective 
transmission rate by one-third. 

Unidirectional systems are free from the above problems. Such systems have 
also an advantage that they are compatible with photon sources of true single 
photons or quantum correlated photon pairs, which are believed to provide 
higher key rate after a long distance transmission. The difficulty in the uni- 
directional system has been the stabilization of two remote interferometers to 
achieve high visibility. The system should solve the conflict between stability 
and transmission distance. Recently, three systems have been reported that 
overcome such difficulty One system employs an active control using fiber 
stretcher. The system performed a 122 km fiber transmission with QBER of 
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Fig. 13. Schematics of the integrated-optic interferometer system for quantum key 
distribution. LD: laser diode, ATT: attenuator, APD: avalanche photodiode, DS: 
discriminator, CT: counter, H: 180° hybrid junction. 

8.9 %[121] and a continuous quantum key distribution session of 19 hours 
over a 20.3km installed telecom fiber [122]. In the latter experiment strong ref- 
erence pulses were sent between the quantum signals for the active control. 
Another system installs an automatic compensation on polarization fluctua- 
tion by Faraday mirrors in the Michelson interferometers at the both sites. A 
125 km QKD transmission from Beijin to Tianjin has been reported [123]. The 
third solution is to use an integrated-optic interferometers based on planar 
lightwave circuit (PLC) technology [124]. The PLC technology provides a sta- 
ble interference with a simple setting. The longest distance transmission over 
a 150 km fiber has been achieved[125]. The detail of the PLC system will be 
described in the following. 

The interferometers, asymmetric Mach-Zehnder Interferometers (AMZs) with 
a 5-ns delay in one of the arms were fabricated on a silica-based PLC plat- 
form. Since the AMZs were fabricated using the same mask, they had the 
same path length difference between the two arms. The optical loss was 2 
dB (excluding the 3-dB intrinsic loss at the coupler). Polarization-dependent 
loss was negligible (0.32 dB). One of the couplers was made asymmetric to 
compensate for the difference in the optical loss between the two arms, so the 
device was effectively symmetric. A Peltier cooler attached to the back of the 
substrate enabled control of the device temperature with up to 0.01 °C preci- 
sion. Polarization-maintaining fiber (PMF) pigtails aligned to the waveguide 
optic-axis were connected to the input and output of the AMZ. 

Two AMZs were connected in series by optical fiber to produce a QKD inter- 
ferometer system (Fig. 13). Optical pulses that were 200 ps long and linearly 
polarized along one of the two optic-axes were introduced into the PMF pig- 
tail of Alice's AMZ from a DFB laser atl550 nm. The input pulse was divided 
into two coherent output pulses polarized along the optic-axis of the output 
PMF, one passing through the short arm and the other through the long arm. 
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Fig. 14. Photon counting probability against transmission distance. Open triangles 
indicate the results in the P&P system. Inset: Fringe observed in photon count rate, 
obtained by changing the device temperature at 150 km. 

The two optical pulses were attenuated to the average photon number of 0.2. 
The two weak pulses propagated along the optical fiber and experience the 
same polarization transformation. This is because the polarization in fibers 
fluctuates much slower than the temporal separation between the two pulses. 
After traveling through Bob's AMZ, these pulses created three pulses in each 
of the two output ports. Among these three pulses, the middle presents the 
relative phase between the two pulses. The interfering signal at the middle 
pulses was discriminated by adjusting the applied gate pulse timing. The sys- 
tem repetition rate was 1 MHz to avoid APD after-pulsing. 

Precise control of the relative phase setting between the two AMZs and the 
birefringence in the two arms of Bob's AMZ are necessary to obtain high vis- 
ibility. Both can be done by controlling the device temperatures. To set the 
phase, it is sufficient to control the path length difference within AL = X/n, 
where n ~ 1.5 is the refractive index of silica. The path length difference de- 
pends linearly on the device temperature with 5 /xm/K, due to the thermal 
expansion of the Si substrate. The birefringence in the two arms can be bal- 
anced by controlling the relative phase shift between two polarization modes, 
because the two arms have the same well-defined optic-axes on the substrate. 
If the path length difference is a multiple of the beat length ALb = A/ An, 
where An is the modal birefringence, the birefringence in the two arms is bal- 
anced and two pulses interfere at the output coupler of Bob's AMZ no matter 
what the input pulse polarization is. Since An/n was the order of 0.01 for our 
device, the birefringence was much less sensitive to the device temperature 
than the relative phase. Therefore, we could easily manage both the phase 
setting and the birefringence balancing simultaneously. 

The photon counting probability given by the key generation rate divided by 
the system repetition rate is plotted as a function of transmission distance 
(Fig. 14). The measured data fit well with the upper limit determined by the 
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loss of the fiber used ( 0.22 dB/km). In Fig. 14, the base lines present the dark 
count probabilities. The interference fringe is shown in the inset. The visibility 
at 150 km was 82 % and 84 % for the two APDs[125], which corresponds to a 
quantum bit error rate (QBER) of 9 % and 8 %, respectively. These satisfy the 
rule-of-thumb for secure QKD. The interference was stable for over an hour, 
which is good enough for a QKD system. The present system could achieve a 
much longer transmission distance than was attained in a previous experiment 
using the autocompensating system. The PLC system was shown to be stable 
for more than three hours with only the temperature control at each local site. 

A similar QKD implemmentation has been proposed to keep security over 146 
km fiber transmission by using strong reference light [126]. 

3.3 Eavesdropping and security 

3.3.1 Attacks to weak coherent light BB84 

As we have observed, weak coherent states will work as a good approximation 
of single photon states. Nevertheless, coherent state pulses may contain multi- 
photon with small but non-negligible probability. The multi-photon states 
would give Eve an opportunity to obtain more information on the transmit- 
ted photon states than the single photon states. Two approaches have analyzed 
the security of the weak coherent light BB84 protocol. One assumes that any 
multi-photon state will provide the full information on the photon states, and 
tries to limit the probability of multi-photon states. This approach will yield 
the upper bound of the Eve's information and the conation of the uncondi- 
tional security against all the possible attacks allowed by the laws of quantum 
mechanics. The other approach limits Eve's attack (often to the individual 
attacks) and estimates Eve's information for each attack[105]. This approach 
will provide the security conditions useful to design practical QKD systems. 
We here concentrate ourselves to the latter approach. The former approach 
will be discussed in the following chapter. 

Our assumptions in the present analysis are the following: 

• Weak Coherent Light: QKD system uses coherent light whose average pho- 
ton number per pulse is set less than one. The photon state may not be 
coherent state, as long as the photon number distribution obeys Poisson 
distribution. It will make the analysis easier to assume no phase correlation 
between the pulses. This assumption also prevents Eve to perform coherent 
attacks. 

• Individual Attack: Eve measures one qubit at a time. Eve can store a qubit 
in a quantum memory till useful information is disclosed. Eve can also store 
the measurement results in conventional memories to analyze the results 
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statistically. The assumption of individual attack implies that the informa- 
tion obtained by the measurement on n qubits equals to the n times the 
information obtained by the measurement on one qubit. 

• No PNS: As we shall show it later, decoy states can detect a eavesdropping 
that alters the photon number distribution. Therefore, we don't have to 
worry about photon number splitting (PNS) attack[127,128], though it is a 
very strong eavesdropping method. 

• No control on Bob's equipment: Eve cannot control the performance of Bob's 
equipment. For example, Eve cannot change the dark count probability in 
Bob's photon detector. Eavesdropping affects the error rate originated in 
the transmission line. As a result, Eve's information on the key depends 
only on the error rate due to the imperfection of the transmission. Errors 
from the dark count only reduce the mutual information between Alice and 
Bob. 

Eve tries to get the information by the optimal measurement under the above 
conditions. We will not assume no further restriction on Eve's ability. Some 
of Eve's ability may seem too good in the real situation. For example, Eve 
can replace the lossy fibers by lossless ones. Eve can measure the photon 
number contained in a pulse, and determine the optimal measurement. If we 
would stick with realistic eavesdropping under current technology, margin of 
the security would be much increased. However, this too limited approach 
may lose the advantage of QKD that guarantees the security whatever the 
technology may be developed. 

Eve can improve her measurement with the classical information exchanged 
between Alice and Bob. Some information on the key bit are also announced. 
Security analysis should consider the information leakage. The classical infor- 
mation leakage in each step in the protocol is following: 

• Bob show the position of the bits that he detected. Eve knows the position 
of the working bit, but obtains no information on the states. 

• All the basis are disclosed in sifting. Eve can measure the stored qubits with 
the optimal setting with the basis information. 

• In error rate estimation, some bit values are open. It makes no harm, how- 
ever, because they are never used for cipher. 

• Partial information on bit values, parity of several bits, for example, are 
exchanged to detect and correct errors. 

The simplest eavesdropping method is so called absorption-resend attack, 
where Eve measures the photon state and prepares the photon state to send 
Bob according to her measurement. Curty and Lutkenhaus[129,130] exam- 
ined the attack for coherent light. As discussed for single photon, however, 
the absorption-resend attack is not optimal. The optimal individual attack 
for single photon state is given by cloning[131]. Eve sets her cloning machine 
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to interact her qubit (ancilla) with the qubit sent by Alice and measure the 
ancilla to obtain the bit value. Eve may store the ancilla till the basis are 
open in the sifting. Eve can measure photon number in a pulse to prepare her 
cloning machine to be optimal. The photon number is in a different degree of 
freedom from that represents the qubits, so that photon number measurement 
doesnot affect the qubit. 

In BB84, the four qubit states stay in a circle of the Bloch sphere. The optimal 
asymmetric cloning machine for these equatorial qubits is given for a single 
photon state, but is not known for n photon state. We will consider a universal 
cloning machine here, which is suboptimal but the gap is expected to be 
small [132, 129]. Note that the cloning machine should be universal, because 
Eve doesnot know the basis when she applies the machine. A n — > n + 1 
Asymmetric universal cloning machine is given by a unitary transform U as 
follows: 



Eve forwards the first n particles and keeps two particles. Disturbance D to 
the qubits sent to Bob is given by D = 2 ft 2 . The coefficients a and /3 satisfy 



In Eq. (191), &k is a superposition of the operations that applies a Pauli 
operator o^{\k = x, y, z) to one of the n particles.; 



a k = a™ ® l( 2 > ® ■ ■ • ® lW + ■ ■ ■ + 1« ® ■ • • ® l^- 1 ) ® a£ n) . (193) 



This cloning machine is universal, because the result (191) is independent of 
the input particle state \<f>). It is also optimal, in the sense that it yield the 
fidelity F = (n 2 + 3n + 1) / (n 2 + 3n + 2) for the optimal universals cloning 
machine given by Gisin and Massar[133], when we assume identical fidelity for 
the first n + 1 particles. However, it is not optimal as an n — >• n + 2 cloning 
machine, though it uses two ancilla, because the fidelity of the last qubit is 
less than the optimal value. 

Eve's error rate on the key is estimated from the distance between Eve's 
reduced density matrices as 




(191) 



a 2 + n{n + 2)(3 2 = 1. 



(192) 



E (n) 



1 - 



(194) 



2 



where the distance can be measured by the fidelity: 




(195) 
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The reduced density matrix p^ is obtained by tracing out Bob's states from 
U \(f)f n |00) (00| (<j)f n W for each Alice's state \<f>) = |0), |1), |0), |1). Since Eve 
knows the basis when she measures the qubits, she needs to distinguish p^ 
from p$ or p$ from p:™). 

So far, we assume that Eve has an excellent technology to make an optimal 
cloning machine. Now Suppose Eve has a magic fiber that can transmit a pho- 
ton without loss[134]. She can replace the fiber between Alice and Bob by 
her magic fiber and put a beam splitter before the fiber without any change 
in Bob's detection rate, if she set the transmittance T of the beam splitter 
equal to the inverse of the fiber loss. A photon will be detected by either Eve 
or Bob. Since Eve's detection does not correlated with Bob's, Eve will not 
gain any information, if a single photon was sent. However, coherent state 
light provide a finite probability that Bob and Eve detect a photon at the 
same time. If Eve keep the photon until the basis is open, she will obtain 
full information on the photon by measuring it according to the basis. The 
conditional probability of Eve's detection on the photons that Bob detected 
is given by Pes — (1 — exp[— Rp]), where R = 1 — T. This expression is the 
same as Eve's detection probability itself, because the Eve's detection process 
is independent of Bob's. The mutual information between Bob and Eve on the 
key bit therefore reads 

Ibe = Pes- (196) 

It is possible to apply the optimal cloning attack on the output light of the 
beam splitter. This combined attack may be the strongest among the individ- 
ual attacks. Fig. 15 show the mutual information I^b and /be as a function of 
transmission distance, where the parameters are taken from the recent experi- 
ments for (a) long distance [125] (b) short distance but high speed transmission 
[115], as follows: the fiber loss a = 0.22 dB/km, the receiver loss (3 = 5 dB, 
dark count probability Pd = 2 x 10~ 7 /pulse, average photon number p = 0.2, 
visibility of the interference v = 0.96 in 150 km transmission, and a = 0.25 
dB/km, (3 = 1.5 dB, P d = 1 x 10~ 4 , p = 0.6, v = 0.995 in 40 km transmission 
at raw key rate of 100 kbps, respectively. Visibility is usually a measure of 
the quality of the interferometer, but it is also a measure of the disturbance 
by eavesdropping in QKD experiments, where the disturbance D is given by 
D = 1 — v. Impact of the parameters Pd, D, and p is following. Dark counts, 
which result in Bob's error, reduce the mutual information Iab- Disturbance 
increases Eve's information obtained by the cloning attack. Increasing average 
photon number raise the probability that the pulse contains more than two 
photons. Eve can obtain more information by the beam splitter attack. As 
shown in Fig. , the mutual information between Alice and Bob is larger than 
that between Alice and Eve with the present parameters. The results implies 
that the we can extract secure final keys from the transmitted raw keys in the 
experiments [115,125]. 
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Fig. 15. Mutual information Iab and I be as a function of transmission distance. 
(a)the parameters are taken from the long distance transmission experiment [125]: 
a = 0.22dB/km, (3 = 5dB, P d = 2 x 1(T 7 , // = 0.2, v = 0.96. (b) the parameters 
are taken from the short distance but high speed transmission experiment [115]: 
a = 0.25 dB/km, = 1.5 dB, P d =lx 10~ 4 , a = 0.6, v = 0.995P 

3.4 Ideas of unconditional security proof 



We have studied some typical types of Eavesdropping. However, the study 
of some types Eavesdropping itself does not make an unconditional security 
proof, because Eve may have many other choices. A security proof should 
not be dependent on any assumption that restrict Eve's actions which do not 
violate laws of nature. Here we show some ideas of the security proof. Detais 
are presented in the next section. 

Since Bennett and Brassard proposed the first quantum key distribution pro- 
tocol, the proof of the security has been one of the main issues. Several authors 
have presented the proof of the unconditional security assuming a single pho- 
ton source. It has been clarified that the role of the quantum mechanics is to 
set a bound to Eve's knowledge on key. 

Suppose Alice and Bob share a random variable W (n bits). Eve tries to know 
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the random bits without being detected. If Eve's knowledge V about W is at 
most t < n: Renyi entropy is bounded by, i?(W|V = v) > n — t, Alice and 
Bob can distill r = n — t — s bits of secure key K, Eve's mutual information 
on which satisfies [135,136,137] 



I(K;GV) = ^, (197) 



with a random choice of universal hash function G as K = G(W). However, it 
is unknown so far whether the conclusion here for classical communication also 
allpies for quantum case. Since in QKD, Eve may choose to store her ancillas 
first and then directly attack the final key after the privacy aplification stage 
taken by Alice and Bob. 

The first unconditional security proof is completed by Mayers which is based 
on the uncertainty principle and classical error correction code (CSS code). 
As a result of Mayers' proof, Eve's information about the final key shared 
by Alice and Bob must be exponentially close to 0, given whatever type of 
attacking schemes she may take. Mayers proof is rather complex. 

Shor and Preskill[138] simplified Mayers' proof from the viewpoint of (virtual) 
entanglement distillation [137]. Since entanglement purification is equivalent to 
quantum error correction(QEC), Alice and Bob can share nearly maximally 
entangled pure states from degraded entangled photon pairs by performing 
QEC on their sites. Shor and Preskill have shown that the entanglement pu- 
rification protocol can be reduced to BB84 protocol by the following steps. 
The entangled photon source can be in Alice's site. Suppose Alice measures 
one of the photon pair before Bob. The photon state sent to Bob is same as 
a single photon state modulated according to a random number, which cor- 
responds to Alice's measurement result. In this protocol, Alice sends random 
qubits encoded in a random quantum code, and Bob obtains bit values after 
performing QEC. The quantum code can be CSS code, so that this protocol 
is called CSS code protocol. Bob measures qubits on the computational basis 
{X,Z}, and phase does not affect the measurement results. Therefore, QEC 
in the protocol needs not to correct phase errors. Since measurement and QEC 
can commute, i.e., Bob can measure the qubits first and then correct errors 
by a classical code corresponding to the CSS code. This protocol is nothing 
but BB84. Performance of QEC would determine the limit of error rate to 
guarantee the security. The limit, however, will never exceed 25 %, where the 
entanglement between Alice and Bob can no longer be recovered. The security 
of QKD with an imperfect source is then also shown. 
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4 Security proofs and protocols of QKD with weak and strong 
Gaussian states 

This section contains the security proofs and protocols of QKD with real se- 
tups. We shall first review the entanglement purification protocol given by 
Bennett, DiVincenzo, Smolin and Wooters[139] (the BDSW protocol) and 
then reduce it to the security proof of BB84 QKD protocol with perfect 
single-photon source which is a difficult technique. There are a number of 
useful methods for secure QKD directly using laser light, e.g., the decoy-state 
protocol[140,141,142], the SARG04 protocol [143], the protocol with strong 
reference light [144] and the protocol with bright squeezed light [145]. In this 
section, we shall go into some of them after the security proof of standard 
BB84 protocol with ideal source. 



4-1 Entanglement purification and security proof of QKD 

The first security proof of BB84 protocol is given by Mayers [135]. The secu- 
rity proof for QKD can be simplified if Alice and Bob have large quantum 
computers[137]. Later, Mayers' security proof of BB84 protocol was simplified 
by Shor and Preskill [138] based on the simple idea of first doing entanglement 
purification with a CSS code[138,75] and then reducing it to a prepare-and- 
measure protocol (BB84) and distilling the data of measurement outcome by a 
classical CSS code. An excellent tutorial of Shor and Preskill's proof has been 
presented by Gottesman and Preskill [145]. Here we modify Shor and Preskill's 
proof and we present an alternative approach which is based on the idea of 
the (modified) BDSW entanglement purification protocol [139]. By using our 
modified proof, the problems such as how to construct a CSS code or the 
existence of good CSS codes is circuvemented[146]. (Mayers' proof does not 
have these problems but it is rather complex.) 

The first work to relate the security of QKD with quantum entanglement was 
published in 1991 [147]. It was then found that actually one can use the idea 
of quantum entanglement as a mathematical tool to prove the unconditional 
security. If Alice and Bob share a number of perfect EPR pairs, they can 
measure them at each side in Z basis ({|0), |1)}) and use the measurement 
outcome as the shared secure key. Say, outcome |0) for bit value and |1) for 
bit value 1. This key will be perfect and no third party can have any informa- 
tion about it. If the pre-shared EPR pairs are almost perfect (exponentially 
close to the perfect ones), they can also use the measurement outcome as the 
secure key since any third party's information about the key is exponentially 
close to 0[137]. If the pre-shared pairs are noisy but not too noisy, they can 
first purify them into a smaller number of almost perfect pairs which are expo- 
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nentially close to perfect pairs and then obtain the secure final key. This is the 
entanglement-purification-based protocol. We shall use the modified BDSW 
protocol [139] for the entanglement purification and then show how to reduce 
it to a prepare-and-measure one[138,145]. 



4-1.1 Main idea of entanglement purification 

Suppose initially Alice and Bob share N + m raw pairs and each pair is in 
one of the 4 Bell states. The goal of entanglement purification is to distill out 
K < N pairs which are all in the Bell state of \<p + ). We can reach such a goal 
if most of the initially shared raw pairs are in |0 + )[139]. To reach the goal, 
we need first to know the error rate of the raw pairs and then we can locate 
the wrong pairs by hashing. By local bit-flip or phase-flip operations, all the 
outcome pairs will be in state with a probability exponentially close to 
1. The original BDSW protocol[139] requests that each of the raw pairs must 
be in one of the 4 Bell states, i.e., there is no entanglement among different 
pairs. It is then shown by Lo and Chau[137] that actually the result of BDSW 
is unconditionally correct given what ever initial state of the raw pairs. This 
makes the base of the unconditional security of QKD. There are 2 main steps: 
error test and hashing. 



4-1.2 Error test 

The initial N+m shared raw pairs can be in any state, e.g., there could be com- 
plex entanglement among different pairs. But here our task is not to know the 
state of these pairs. We imagine that each shared raw pair is measured in the 
Bell basis in the beginning but no one reads the measurement outcome[145]. 
(As shown later, the fidelity result of purification keeps unchanged if this vir- 
tual Bell measurement in the beginning is omitted.) Therefore each pair is 
now in one of the 4 Bell states and our task is to locate wrong pairs, those 
pairs which are not in state The goal of error test is to see how many 

pairs are bit-flipped (i.e., in state \ip + ) or state and how many of them 

are phase-flipped (i.e., in the state or state |^ - ))- 

We use notations |0), |1) for the eigenstates of operator Z with eigenvalues 
0,1, |0) = ^=(|0) + |1)), |1) = ^g(|0) - |1)) for the eigenstates of operator 
X with eigenvalues 0, 1, and Za®b for the basis of collective measurement of 
parity value in Z basis for a pair. Given any state a\a) a\o) b + /3\a®l) ^©l) b , 
the measurement outcome in Za®b basis will be za®b = a ® b. If Alice and 
Bob do individual measurement at each side in Z basis, there would be two 
outcome, za and zb at each side and we have 

z A ®z B = z a ®b- (198) 
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Remark: Throughout this section, all summation symbols are for the bit wise 
summation, i.e., a®b = Qiia = b and a ®b = 1 if a ^ b. 
Similarly, we can also denote the parity measurement in X basis by Xa®b and 
its measurement outcome is 

xa®b = xa®x b . (199) 



The first question here is how the principles of classical statistics works for 
a quantum system as stated in Ref. [137]. Since Za®b and Xa®b commute, 
one can in principle measure any pair in both Za®b and Xa®b- A pair carries 
a bit-flip error if za@b = 1, a phase-flip error if %a@b = 1- Given N + m 
raw pairs, we can randomly choose m pairs as test pairs. We want to know 
the error rates (including bit-flip rate and phase-flip rate) of the remaining N 
pairs by examining the m test pairs. This is called the error test. 

Since Xa®b and Za®b commute, we can imagine that we had first measured 
each of the m test pairs in both bases and then estimate the error rates of the 
remaining N pairs by examining the measurement outcome of m test pairs. 
Further, we can divide the m test pairs into two subsets and each subset con- 
tains m/2 pairs. We can measure each pair in the first subset in basis Za®b to 
see the bit-flip rate and measure each pair in the second subset in Xa®b basis 
to see the phase-flip rate. If m is very large, the error rates obtained in this way 
must be the same with the error rates obtained by measuring each test pair 
in both Za®b basis and Xa®b basis. Therefore, after measuring one subset of 
the test pairs in Za®b basis only and the other subset in Xa®b basis only, one 
can estimate the (upper bound) values of both bit-flip rate and phase-flip rate 
of the remaining N pairs if these pairs were measured. Since the Bell measure- 
ment and collective measurement Za®b or ^a®b commute, the operation of " 
Bell measurement plus Za®b (Xa®>b)" wm gi ye the same outcome of bit-flip 
rate (phase-flip rate) with that of the measurement of Za®b (Xa@b)> thus the 
virtual initial Bell measurement to those m test pairs can be omitted. Also, 
since all test pairs are discarded, we can actually use whatever measurement 
to those test pairs provided that the outcome tells us the value of za®b of one 
subset and the value of xa®b for the other subset of the test pairs. Therefore 
we can replace Za®b for the first subset by individual measurements in Z basis 
at each side, and Xa®b for the second subset by individual measurements in 
X basis at each side, because the outcome of individual measurements deter- 
mines the outcome of collective measurements by Eq.(199). Further, it makes 
no difference if Alice measures her halves of those test pairs before entangle- 
ment distribution. This means, instead of sharing m pairs with Bob, she can 
simply send Bob m single qubits with each state being randomly chosen from 
|0), |1) and |0), |1) (i.e., BB84 states) for the future error test. 
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4-1.3 Hashing 



After the error test, Alice and Bob now share N raw pairs. For simplicity, we 
shall assume the non-local measurements Za@b-, ^a®b and controlled-NOT 
gates for Alice and Bob at this moment. However, these are only mathematical 
techniques for the security proof. As shown later, all these assumed (virtual) 
operations are not really necessary and the protocol is reduced to the BB84 
protocol. As assumed earlier in the " error test" part, Alice and Bob had 
measured each of the shared N pairs in the Bell basis but they don't look at 
the measurement outcome[145]. Each pair must now be in one of the 4 Bell 
states. The task is to find out the positions of those pairs which are not in 
\<p + ) and then correct the errors. Given iV raw pairs, we can use two iV— bit 
classical binary strings, the bit- flip string Sb and the phase- flip string s p to 
represent the positions of bit-flips and phase-flips. For any ith pair, if it bears 
a bit-flip error, the ith element in string s& is 1, otherwise it is 0; if it bears 
a phase-flip, the ith element in string s p is 1, otherwise it is 0. For example, 
given 5 pairs the two classical strings are 

s b = 00101; s p = 00011. (200) 

The goal is to detect the positions of those pairs bearing a bit-flip error or 
a phase-flip or both. This goal can be achieved by hashing, which consumes 
some of raw pairs and the shortened bit-flip string and phase-flip string for 
those remaining pairs can be determined. If the bit-flip rate and phase-flip 
rate are bounded by t&, t p h respectively, the number of likely bit-flip string 
and phase-string for N raw pairs are bounded by 

Ub = 2*-m) ]Up = 2 »- H M (201) 

respectively and H(x) = — xlog 2 x — (1 — x) log 2 (l — x). (After the error test, 
the values of for the remaining N pairs are known already.) 

To have a clear picture, we consider the result of classical hashing first. Suppose 
we know that there are uj = 2 n candidates for an unknown N— bit classical 
string. We can determine a shorter sub-string by revealing the parity values 
of n + 5N random subsets of elements from the string. Say, each time we 
reveal the parity value of a random subset and then discard one bit in the 
subset. After we have revealed n + 8N parity values, we examine each likely 
candidates for the remaining string whose length is N — n — SN. There must 
be one candidate string s f satisfying all those revealed parity values. And the 
probability that there is another (different) candidate string that also satisfies 
those parity values is only 2~ SN . Therefore, the string for the remaining bits 
are determined. A detailed proof of this is given in [139]. 

(1) Bit-flip error correction. To use the classical result of hashing here, we only 
need to know how to detect the parity value of any subset of the bit-flip string 
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Sb, i.e., the parity of a shorter bit-flip string for any subset of those N raw pairs. 
This can be done by the so-called biCNOT operations and measurements in 
Za®b basis. 

Suppose there are u pairs in a subset E, E = {ei,e 2 ,--- ,e u } is a subset 
that contains pair ei, e 2 , • • • ,e u . The bit-flip string for this subset is s b (E) = 
c ei c e2 ■ ■ ■ c eu and the bit-flip string of N pairs are Sb = cic 2 ■ ■ ■ cn and N > u, 
of course. We want to know the parity value of string Sb(E), i.e., 

53 Q = C ei © C e2 © • • • © C e „. (202) 

We have the following fact 

53 Q = 5] zakbbi (203) 

Here zai®bi is the outcome data for pair I if it is measured in Za®b basis. 
However, as shown below in obtaining J2i&e c u we do NOT have to know each 
individual value of q. 

A CNOT gate in Z basis is a gate that takes the following transformation: 

|*i)|2 2 ) — > \z 1 )\z 1 @z 2 ). (204) 

Here the first state is the control state, the second state is the target state, 
z±,Z2 can be any value from {0,1}. A biCNOT gate contains two CNOT 
gate, one in Alice's side the other in Bob's side. Explicitly, we first denote 
10"), by |xoo), Ixoi), Ixio), Ixn), respectively. That is to say, 

for any pair state \xb, P h), the parity value za^b = b, xa®b = ph. Given two 
pair state \xbi,phi) \Xb 2 ,ph 2 )y if we do a biCNOT in Z basis on these two pairs 
with the second pair being the target, we have 

hiCNOTz(\xbi,phi)\Xb2,ph2)) = \Xb 1 , P h 1 ® P h 2 )\Xb i©&2 , P h 2 

). (205) 

This means, a biCNOT operation will collect the parity value zai®bi®za2®B2 = 
b\ © b 2 into the target pair. Given Eq.(205), we can know the parity of string 
Sb(E) by the following way: 1. Gather J2i^e z ai+bi into pair d G E by per- 
forming biCNOT gates between pair d and other pairs in set E, with pair d 
being the target pair. 2. Measure pair d in basis Za@b- 3. Discard pair d. For 
example, to know the parity of bit-flip substring Sb(E) = C!C 4 c 5 , they can first 
do biCNOT operations in Z basis as shown in Fig. 16, then measure pair 5 in 
basis Za®b and then discard pair 5. 

They repeat this for q = NH(tb) times and Bob can compute the bit-flip string 
for the remaining N — q pairs, i.e., he knows all positions where the pair bears 
a bit-flip error. Bob flips those of his qubits from bit-flipped pairs in Z basis. 
The bit-flip error correction is completed here. 
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Fig. 16. They first do biCNOT operations in Z basis and then measure the target 
pair (pair 5) in order to obtain the parity value for the bit-flip string of a subset E 
which contains pair {1,4,5}. 

However, the phase-flip string for the remaining N — q pairs is not deter- 
mined yet. In doing the hashing for bit-flip string, the phase-flip string for the 
remaining pairs changes. However, the number of likely phase-flip string for 
the remaining pairs cannot be larger than u p , the number of likely phase-flip 
string for the initial N raw pairs. Because the initial phase-flip string of ./V 
pairs determines the phase-flip string of the remaining pairs after bit-flip hash- 
ing. Eq. (205) shows that given the initial phase-flip string, the later phase- flip 
string for the remaining pairs is determined exactly. Keeping this fact in the 
mind, they can then correct phase-flip errors: 

(2) Phase- flip error correction. They can also do hashing in X basis. Eq.(205) 
shows that the biCNOT operation can collect the parity value xaiqbi © 
XA2®B2 = phi © ph,2 into pair 1, i.e., the control pair. Therefore, given any 
set E, they can randomly choose pair d as the control pair and all the other 
pairs in set E as the target pair. They perform biCNOT gates between pair 
d the other pairs in set E. The parity value of J2ie.E x ai®bi before biCNOT 
operation can be obtained by measuring pair d in Xa&b basis after the biC- 
NOT operations. With this they can do hashing to correct phase-flip errors. 
Explicitly, at any step j > q, Alice announces Ej which is a random subset 
of all remaining pairs and pair dj G Ej. They do biCNOT operations in Z 
basis to collect the parity value J2ieEj ( x ai ® xbi) at pair dj. Pair dj, the only 
control pair is discarded after it is measured in Xa®b basis. They repeat this 
for p = NH(t p h) times and Bob can compute the phase-flip string for the 
remaining N — p — q pairs, i.e., he knows all positions where the pair bears 
a phase-flip error. Bob correct those phase-flipped pairs by a taking a phase 
shift operation to his own qubits. The purification is ended here. 
Remark: Similar to the phase-flip hashing also needs the biCNOT gates in Z 
basis. But the target pair and control pair are reversed. 



4-1-4 Reduction 

The above virtual entanglement purification protocol contains the following 
elementary operations: 
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• Bell measurement to each raw pair in the beginning 

• biCNOT gates 

• measurement in Za®b basis and measurement in Xa®b basis. 

The nonlocal measurements here are impossible tasks for Alice and Bob who 
are spatially separated. The CNOT operations are difficult tasks. We can get 
rid of all these in the real protocol by reduction. 

Since the Bell measurement commutes with biCNOT gates and any measure- 
ments in Za§b basis and measurement in Xa®b basis, we can delay the initial 
Bell measurement until the end of the protocol and we shall obtain the same 
state p for the outcome K pairs. We denote this protocol as protocol VI. 
Suppose the fidelity F = (4> +K \p\4> +K ) = 1 — e for the outcome pairs and e is 
exponentially close to 0. Consider another protocol V2 which simply skips the 
Bell measurement and performs everything else the same as protocol VI. The 
outcome K— pair state in protocol V2 is p'. obviously, if the Bell measurement 
were performed to each outcome pair of protocol V2, the state of the outcome 
pair of protocol V2 must be the same with that of protocol VI. Therefore, 

P = E (R{bvffihy}\p'\K{byJ>hy})\^b v #hy})(K{b y ,phy}\ ( 20 6) 

{by,phy} 

and \H-{b y ,phy}) = \Xb u phi) ■ ■ • \Xb K , P h K ), and any b y or ph y can be or 1. Also, as 
defined earlier, any \xa y b y ) is one of the 4 Bell states depending on its subscript 
value. This leads to 

(4> +K \p'\^ K ) = (4> +K \p\^ K ) = l-e (207) 

which means, although the outcome state of protocol VI and V2 can be dif- 
ferent, the fidelity results of the two protocols are the same. Since Eve's in- 
formation upper bound is dependent on F only [13 7], protocol VI and V2 are 
the same secure. We shall only consider protocol V2. 

There are still some other non-local measurements of Za®b an d Xa&b i n 
the protocol. However, since all these are performed on the pairs which are 
discarded in the protocol, it makes no difference if they take any further opera- 
tions to the discarded pairs. In the step of bit-flip correction, they can measure 
the discarded pairs in Z basis at each side and obtain YjIze z ai and J2i&e z bi 
separately and then calculate the parity value by formula 

E c * = E^ + E^- ( 208 ) 

i£E leE leE 

The individual measurement in Z basis at each side commutes with the non- 
local measurement Za®b therefore they can exchange the order of the two 
measurements. Furthermore, since the individual measurements in Z basis 
determines the outcome of the collective measurement Za^b, the collective 
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measurement is unnecessary. This is to say, in the protocol V2, all those nonlo- 
cal measurements Zz®b can be simply replaced by the individual measurement 
in Z basis at each side. 

The bit-flip error correction is now reduced to the following: At any step i, 
Alice announces Ei which is a random subset of all remaining pairs and pair 
di G Ei. They do biCNOT operations in Z basis to collect the parity value 
J2i£Ei ( z ai © zbi) at pair dj. They measure the target pair in Z basis at each 
side. Alice announces her measurement outcome, i.e., J2ieEi z ai- Bob calculates 
(SzeEi z ai) ffi {12i£Ei z bi) an d this is just the parity value of string Sb(Ei), the 
bit-flip string of pairs in subset Ei. They discard pair di. 

The phase-flip correction can also be simplified. Due to the same reason as 
stated above, after the biCNOT gates in a subset Ej is done, the non-local 
measurement Xa®b on the control pair can be replaced by measuring the 
control pair in X basis in each side because that pair will be discarded. Since 
their only purpose is to obtain a secure final key, they need not really correct 
the phase-flip errors. After Bob has known the positions of all phase-flips 
for the remaining pairs, he does not need to really correct the phase errors 
because this does not change the bit values of the final key and actually no 
one knows whether he has performed the correction. Therefore he even does 
not need to compute the positions of the phase errors provided that he can 
do so. Consequently, the measurement in Xaqb basis on the control pair is 
unnecessary and they can directly discard the pair without any measurement. 
This is to say, at each step of hashing for phase-flip string, they only need to 
do some biCNOT operations in Z basis and directly discard pair dj. Thus, all 
operations needed in both bit-flip correction and phase-flip correction can now 
be done in Z basis. Therefore, Alice can choose to measure all her halves of 
N pairs in Z basis before sending anything to Bob, i.e., she can directly send 
Bob N random qubits in Z basis and Bob can measure each of them before 
key distillation. The final key distillation becomes the distillation of the data 
from the measurement outcome in Z basis at Bob's side. 

We shall simply use error correction for the term bit-flip error correction be- 
cause the phase-flip error correction is now reduced to the Privacy ampli- 
fication: At any step j > q, Alice's bits and Bob's bits are identical. Alice 
announces a random subset Ej and bit dj G Ej. For any I G Ej, they replace 
Z\ by z\ © Zd 3 and they discard bit dj. Here zi is the bit value of the Ith bit in 
Ej. They need to repeat so by p steps and obtain the final key. 

If they don't use a quantum memory, Bob must measure each qubit once he 
receives it. In such a case Bob has no way to know the right basis of each 
individual qubit. Bob can randomly choose basis Z or X. They must discard 
those outcome from a wrong basis (basis mismatch). We have the following 
prepare-and-measure protocol: 
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(0) Alice and Bob have agreed that states |0), |0) represent for bit value and 
states |1), |1) represent for bit value 1. (1) Alice prepares 2(N + m) qubits. 
The preparation basis of each qubit is random, with a prior probability of 
P z = o^~!~"\ for Z basis, and P x = t^th — r for X basis. The bit value of each 

z 2(N+m) ' x 2(N+m) 

individual qubit is randomly chose from and 1. (2) Alice sends these qubits to 
Bob and Bob measures each of them in a basis randomly chosen from {X, Z}. 
Bob announces his measurement basis for each qubits and they discard those 
outcome from a measurement basis that is different from Alice's preparation 
basis. Approximately, there should be N + m classical bits remaining among 
which about m/2 are X bits (outcome of measurement in X basis) and iV + 
m/2 are Z bits (outcome of measurement in Z basis). (3) Bob announces the 
bit values of all X bits and the same number of Z bits for error test. They 
discard all the announced bits and there are about N bits remaining. After 
this error test, they know that the bit-flip rate and phase-flip rate for the 
remaining N bits are bounded by t b , t p h respectively. (4) They do bit-flip error 
correction and privacy amplification to the remaining N classical data as we 
have stated previously and obtain the final key. The final key rate is 

f = l-H(t b )-H(t ph ). (209) 

In the case t& = t p h = t, the noise threshold for BB84 protocol is 11% where 
its key rate hits 0. However, if we use the encoded BB84 states and/or if 
the key distillation is done with two-way classical communication, the noise 
threshold can be raised significantly, see e.g., Ref. [148,149,150,151]. Moreover, 
if the channel noise is asymmetric, one can also raise the efficiency [152]. 

Remark Besides the approach of entanglement purification, Koashi has pre- 
sented another simple and clear picture based on the uncertain principle [153]. 



4-2 Secure key distillation with a known fraction of tagged bits 

Although many QKD protocols such as the BB84[3] have been proven to be 
unconditionally secure[135, 137,138], this does not guarantee the security of 
QKD in practice, due to various types of imperfections in real-life set-ups. 
In practical QKD, the source is often imperfect. Say, it may produce multi- 
photon pulses with a small probability. Normally, weak coherent states are 
used in practice. The probability of multi-photon pulses is around 10% among 
all non-vacuum pulses. Here we shall show how to generate the secure final key 
even though the source is imperfect, i.e., with a small probability of sending 
multi-photon pulses. 
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4-2.1 Final key distillation with a fraction of tagged bits. 



For simplicity, let us imagine the following virtual case: Alice now sends Bob 
the BB84 states (with most of them being prepared in Z basis) from a perfect 
single-photon source. But, before sending out any states, she randomly chooses 
a small fraction of the qubits and tells Eve the right bases (and bit values) 
of them. This small fraction of qubits are called tagged qubits. It was shown 
by ILM-GLLP[154] that we can also distill the secure final key by a CSS 
code even with an imperfect source, if we know the bit-flip rate, phase-flip 
rate and upper bound value of the fraction of tagged bits, A. Here we give 
a simple proof. Suppose after Bob has measured each qubits he received and 
they discarded those outcome with basis mismatch, there are N + m classical 
bits remaining. About m of them will be used for error test, among which a 
half are Z bits and a half are X bits. The remaining N bits are all Z bits and 
they will be used for the final key distillation. We shall call them as untested 
bits. At this stage, any bit that is caused by a tagged qubit is a tagged bit. 
We assume Alice and Bob carry out the protocol as if they didn't know which 
ones are tagged qubits but they know the fraction of tagged bits, A. They now 
distill the final key with those N untested bits. They need to know the number 
of likely bit-flip string and the number of likely phase-flip string for those N 
untested bits. The error correction part is of no difference from that of the 
ideal protocol where there is no tagged bits, i.e., after they do the error test, 
they know that the upper bound of the bit-flip rate of those N untested bits 
is U- We shall use notations t^tag, h,untag for the upper bounds of bit-flip rates 
of the tagged bits and untagged bits from those N untested bits, respectively. 
We have 

Atbjag + (1 — &)tb,untag = U (210) 

Here i& is the averaged bit-flip rate of all those untested bits. The value of tb 
satisfies 

t b <t z + 5 1 (211) 

and t z is the observed bit-flip rate of those test bits in Z basis, 8\ is a small- 
value parameter due to the statistical fluctuation. The number of likely bit-flip 
string is bounded by 



2ANH(t bitag ) . 2( 1 - A ) NH ( t b,u n tag) < 2 NH ( t b). (212) 



Since they don't know the refined error rates for tagged bits and untagged 
bits separately, they can only use the value 2 NH ^ as the number of likely 
bit-flip string for error correction. What is a bit tricky is the number of the 
likely phase-flip string. Also, there are two groups of bits of the N untested 
bits, tagged bits and untagged bits. If the number of phase-flip string for the 
tagged bits is bounded by 0J P h,tag an d the number of phase-flip string for those 
untagged bits is bounded u) p h, U ntag then the number of phase-flip string for all 
N bits is bounded by 

^ph ^ph.untag ' ^ph,tag- 

(213) 
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Give any binary string of length y, in whatever case the number of likely string 
is bounded by 2 y . Therefore we have 

U ph ,tag < 2 AN . (214) 

To bound the value of uj ph:Untag , we must bound the phase-flip rate of those 
untagged untested bits. Asymptotically, this value is given by the error rate 
of those untagged test bits in X basis. The observed value t x is the averaged 
error rate of all those X bits (all the X bits are used for test) among which 
only a fraction (1 — A) are untagged bits. Therefore, the separate error rate 
for the untagged X bits could actually be larger than the averaged one, t x 
but it must be bounded by t x /(l — A) which corresponds to the worst case 
that all errors in X— basis are carried by those untagged X bits. Therefore the 
phase-flip rate of those untagged untested bits are bounded by 

t ph <j^ + S 2 . (215) 

Here 62 is a small-value parameter due to the statistical fluctuation. Therefore 
the number of likely phase-flip string of all those untested bits is bounded by 

u; ph <2 AN -2^ NH ^ +52 K (216) 

If N(l — A) is very large, 8\, 62 are a very small. Asymptotically, the final key 
rate is 

/ = 1 - H(t z ) - A - (1 - A)£T( r ^-) (217) 
which confirms the result of ILM-GLLP[154]. 

Remark: The bit-flip and phase-flip for a tagged bit is rather different. Consider 
the case with real entanglement. Once Alice tells Eve in advance the bit value 
in Z basis of certain pair, Alice must have already measured it in Z basis. The 
phase-flip is immediately very large even Eve does not touch it in the future. 
However, the bit-flip can still be given a noiseless channel. 

The above model applies to the important situation that Alice uses the source 
of weak coherent light, i.e., the weak light directly from a laser device. Say, the 
source may sometimes produce the multi-photon pulses. Obviously, to Alice 
and Bob, the situation here cannot be worse than the situation of tagged-bit 
model where Alice announces some of the basis (and bit values) therefore it 
must be secure here if they use the model of tagged bits to treat the imperfect 
source, provided that they know the value A for the raw bits. In the case of 
using the coherent light as the source, if a bit is created at Bob's side due to 
a multi-photon pulse from Alice, that bit is regarded as a tagged bit. If the 
channel is lossy, it is not a trivial task to know the tight upper bound of the 
fraction of tagged bits, A. Since we need to assume the channel to be Eve's 
channel for security, the channel transmittance can be very different for those 
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single-photon pulses (untagged qubits) and those multi-photon pulses (tagged 
qubits). Therefore the fraction of multi-photon pulses of the source can be 
very different from the fraction of tagged bits in Bob's raw key. In particular, 
if the channel is quite lossy, since Alice doesn't know which pulses are single- 
photon pulses, it is possible that the channel transmittance for single-photon 
pulses is and all bits in Bob's raw key are tagged bits. This means, without 
a good method to upper bound A tightly, the maximum secure distance for 
QKD with weak coherent light of intensity not less than 0.1 is about only 20 
kilometers given the existing detection technology [154]. 



4.2.2 PNS attack 

In practice, the channel can be very lossy. For example, if we want to do QKD 
over a distance longer than 100 km using an optical fiber and the light pulses 
of wavelength 1.55 fim , the overall transmittance can be in the magnitude 
order of 10~ 3 or even 10~ 4 . (Suppose the detection efficiency is around 10%.) 
This opens a door for the Eve by the so called photon-number-splitting (PNS) 
attack[127,128] as shown in figure (17). Suppose at a certain time Alice sends 
out a multi-photon pulse. Every photon inside the same pulse is in the same 
state in coding space, e.g., the polarization space. Eve can keep one photon 
from the pulse and sends other photons of the pulse to Bob through a trans- 
parent channel. This action will not cause any noise in the coding space but 
Eve may have full information about Bob's bit: After the measurement basis 
is announced by Alice or Bob, Eve will be always able to measure the pho- 
ton she has kept in the correct basis. Therefore, here we regard all those bits 
caused by multi-photon pulses from Alice as the tagged bits. According to the 
model given by ILM-GLLP[154] as we have studied, if the fraction of tagged 
bits in Bob's raw key is not too large, we can still obtain a secure final key by 
equation (217). In using this result, we must first know the value A. Alice does 
not know which pulse contains more than one photons, she only knows a dis- 
tribution over different photon numbers for all pulses. As we have mentioned, 
the fraction of multi-photon pulses from the source can be very different from 
the fraction of tagged bits in Bob's raw key, for, Eve's channel transmittance 
can be dependent on the photon number of the pulse from Alice. Naively, 
one can assume the worst case to estimate A: the channel transmittance for 
multi-photon pulses is 1 and we check how many raw bits are generated. If the 
number is larger than the number of multi-photon pulses, there must be some 
untagged bits. However, in such a way, the light intensity must be rather weak 
in order to have some untagged bits. Suppose the channel transmittance is rj 
and the light pulse intensity is x. The density operator of a phased randomized 
coherent state of intensity x is 

A^^E^-HH- ( 218 ) 
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Fig. 17. Schematic diagram for photon-number-splitting attack. Eve is in the middle 
and controls the channel. If Alice sends a single-photon pulse (untagged qubit), Eve 
may absorb it. If Alice sends a multi-photon pulse, Eve may split it and keeps one 
photon. Of courses, Eve has many other choices. 

Consider the normal case that there is no Eve, the channel transmittance is rj 
to every photon. If Alice sends N pulses, Bob will find N (l — e~ vx ) counts at 
his side. However, for security, they have to assume this to be Eve's channel. 
Using the naive worst-case estimation, we require 

1 - e- vx > e"V/2, (219) 

i.e., 

xe~ x < 2-q. (220) 

This shows, to guarantee that not all raw bits are tagged bits, the efficiency 
must be bounded by rf. Given that x > 0.1, we request r] > 4.5% to obtain 
non-zero secure key. For security, we have to assume that Eve can also control 
the instantaneous detection efficiency of Bob's detector. Thus, if Bob's detec- 
tion efficiency is 10% and the the light intensity loses a half over every 15 km, 
the cut off distance is not larger than 20 km. To obtain the secure final key 
with a meaningful key rate, we must have a better way to verify A, upper 
bound of fraction of tagged bits in raw key. 

Remark. Bob cannot verify the tagged bits at his side by measuring the photon 
number in each coming pulses. Suppose he finds certain pulse contains only 
one photon. The bit caused by that pulse could be still a tagged bit because 
the pulse could have contained two photons when Alice sent it. It is the photon 
number in the pulse at Alice's side that only matters for the security here. 

Earlier, the PNS attack has been investigated where Alice and Bob monitor 
only how many non-vacuum signals arise, and how many errors happen. How- 
ever, it was then shown[155] that the simple-minded method does not guar- 
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antee the final security. It is shown [155] that in a typical parameter regime 
nothing changes if one starts to monitor the photon number statistics as Eve 
can adapt her strategy to reshape the photon number distribution such that 
it becomes Poisonian again. Finding a faithful and tight upper bound for A 
value is strongly non-trivial because Eve can produce whatever type photon- 
number-dependent lossy channel that does not violate laws of the nature. Al- 
though some types of specific PNS attack, e.g., the beamsplitter attack could 
be detected by simple method such as tomography at Bob's side, a method to 
manage whatever lossy channel is strongly non-trivial. 

In short, given ILM-GLLP[154] result, the remaining task is to verify the 
fraction of tagged bits in Bob's raw key faithfully. A reliable tight verification 
is non-trivial. The central task for the decoy-state method is to make a tight 
verification of A, the upper bound of the fraction of tagged bits or equivalently, 
Ai, the lower bound of the fraction of untagged bits in Bob's raw key. 

Remark: In the above, in showing that certain old protocol is insecure, we have 
used some specific attacking schemes. Of course Eve can have many choices in 
the attack, e.g. methods in Ref[155]. Definitely, in showing that certain proto- 
col is secure, one should not assume any specific attacking scheme. We are now 
going to present the decoy-state method which does not assume any specific 
attacking scheme. The security of this method is only based on principles of 
quantum mechanics and classical statistics therefore is unconditional. 

4-3 Decoy-state method 

The first idea of decoy-state method and the first protocol is given by Hwang[140] 
Hwang proposed to do the non-trivial verification by changing the intensity 
of pulses. In Hwang's first protocol, two intensities are used. The intensity of 
signal pulses is set to be around 0.3 and the intensity of decoy-state pulses is 
set to be 1. By watching the counting rate of decoy pulses, one can deduce 
the upper bound of the fraction of tagged bits among all those bits caused by 
signal pulses. For the conceptual clarity and the mathematical simplicity, here 
we give up Hwang's original statement and derivation and we shall directly 
use the technique of density matrix convex[141] where only a few parameters 
are involved[141]. 

4-3.1 Basic idea and protocol 

We start from the classical statistics. 

Proposition 1. Given a large number of identical and independent pulses, the 
averaged value per pulse of any physical quantity for some randomly sampled 
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pulses must be (almost) equal to that of the remaining pulses, if both the num- 
ber of sampled pulses and the number of the remaining pulses are sufficiently 
large. 



In a standard QKD protocol with a perfect single-photon source, this propo- 
sition is used for the error test: They check the error rate of a random subset, 
and use this as the error rate of the remaining bits. Also, this proposition can 
be used for estimation of the averaged value of any other physical quantities, 
such as the counting rate. In the protocol, Alice sends pulses to Bob. Given 
a lossy channel, after a pulse is sent out from Alice, Bob's detector may click 
or not click during a certain time window. If his detector clicks, a raw bit is 
generated. Counting rate is the ratio of the number of Bob's clicks and the 
number of pulses sent out from Alice. More specifically, if source x sends out 
N x pulses and Bob's detector clicks n x times in the appropriate time windows, 
the counting rate for pulses from source x is 



Obviously, this quantity for any real source can be directly observed in the 
protocol itself. In the QKD protocol, Alice controls the source. We shall use 
the concept of a mixed source. Source X and source Y together make a mixed 
source if the following conditions are satisfied: (1) Each individual pulse has 
a probability px to be produced from source X and probability py to be 
produced from Y. (And px +Py = 1-) (2) The state of each individual pulses 
are independent. (3) Except for the states in the photon- number space, pulses 
from source X and pulses from source Y are indistinguishable by any other 
physical quantities, e.g., the wavelength, the polarization, the transmission 
path and so on. In particular, if X and Y make a mixed source and states 
of pulses from each source are identical in photon-number space, then the 
counting rate of source X must be equal to that of source Y, since in such a 
cases all pulses are identical and pulses from X can be regarded as the sampled 
pulses and pulses from Y can be regarded as the remaining pulses in using 
proposition 1. 

Proposition 2. Given that the light pulses from a mixed source that contains 
source X and source Y, if X and Y produce the same states in photon- number 
space, the counting rate for pulses from source X must be equal to that of 
source Y, provided that the number of pulses from each source is sufficiently 
large. 

One intensity we shall use in the protocol is /i. Imagine that all pulses of 
this intensity is produced by source A^. The state can be re- written in the 
following equivalent convex form: 




(221) 



p M = e-^|0)(0|+/ie^|l)(l|+ C p c 



(222) 
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and c = 1 — e M — /xe ^ > 0, 




(223) 



and Pfj,(n) = - — 7 — . This convex form shows that the source sends out 3 types 
of pulses: sometimes sends out vacuum, sometimes sends out |1)(1|, sometimes 
sends out pulses of state p c . Therefore, source can be equivalently regarded 
as 3 sources, A^o producing those vacuum pulses, A^i producing those single- 
photon pulses and A^ c producing those pulses in state p c . Nobody outside 
Alice's lab can tell whether Alice has actually used these 3 sources or A^, the 
real source. Those of Bob's bits due to the counts caused by the pulses in 
state p c from Alice are regarded as tagged bits. Since we know explicitly the 
probability of pulses p c for the source, we shall know the fraction of tagged 
bits if we know s c , the counting rate of state p c . The counting rate of any 
state p is the probability that Bob's detector counts whenever Alice sends out 
a pulse in state p. Suppose that Alice has another source, A' which always 
produces state p c and Alice sometimes uses A^ sometimes uses A'. This is to 
say, Alice uses a mixed source that contains A^ and A'. Since A^ itself can 
be regarded as three sources, we can also say that Alice has used source A^o, 
A ni and a mixed source that contains A^c and A'. Since the state of pulses 
from A^c is identical to that of A' in photon-number space, according to our 
proposition 2, pulses from source A^c and pulses from source A' must have 
the same counting rate. This is to say, by watching the counting rate of pulses 
from source A', Alice can judge the counting rate of all those multi-photon 
pulses from source A^. We can have the following artificial protocol: Alice 
sends many pulses to Bob with two sources, A^, A'. Among all these pulses, 
he knows which N' pulses are produced by source A'. After Alice sends out all 
pulses, Bob announces which time his detector has counted and which time 
has not. Alice finds that among all those counts at Bob's side, n' of them are 
due to those pulses from source A'. Then Alice knows the counting rate of 
source A' is n'/N'. This is also the counting rate of source A^, which is just 
the counting rate of all those multi-photon pulses from source A^. Note that 
Eve cannot treat the pulses from source A' and the pulses from source A^c 
differently. 

In the above artificial model, we have used source A' that only produces state 
p c . In practice we don't have such a source. But we can have another coherent 
light source, A^ which produces a coherent state with averaged photon number 
(intensity) pi (jj > p,p'e~^ > pe~^). We now consider the case that Alice 
uses a real mixed source that contains source A^ which produces the coherent 
state with averaged photon number (intensity) p and source A^. Alice can use 
only one laser device to produce such a mixed source by randomly switching 
the intensity between p, p! . Since p! > p and p'e~^ > pe~^, the state for 
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source A u > can be written in the convex form: 



fa = e~< l '\0)(0\+fi'e-> 1 '\l)(l\ + c^—-p c + dp d . (224) 

p z e v 

Here d > and pd is a density operator. We don't need the explicit formula for 
Pd-, we shall only need the fact that state p^i can be written in the above convex 
form. Source can be equivalently regarded as 4 virtual sources: A^iq which 
contains all vacuum pulses from A^, A^i which contains all single-photon 
pulses from A^, A^i c which contains all p c pulses of source A^ and A^ d 
that contains all pd pulses of source A^ . Also, source A^ can be equivalently 
regarded as 3 sources as we have mentioned before. Of course, A^c and source 
A^c make a mixed source and they produce identical states in photon number 
space. This means, by proposition 2, s c (p), the counting rate of state p c from 
source A^ is equal to s c (p'), the counting rate of state p c from source A^, i.e., 

s c (/-0 = s c (p) = s c . (225) 

By the same reason we have a more general formula for counting rate 

s a (p) = s a (p!) = s a . (226) 

Here the subscript a represents for a state. We shall use a — 0,1, c for (the 
counting rates of) vacuum state, single-photon state and state p c respectively. 
Remark: Source A^ and A^ are not identical and Eve can treat pulses from 
these two sources differently. But source A^ a and A^ a are identical and Eve 
cannot treat pulses from these two sources differently. 

Here Alice has only used two real sources, A^, A^. Counting rate of any real 
source can be observed directly in the protocol. But counting rate of a virtual 
source e.g., A^ c cannot be observed directly. We must deduce it mathematically 
based on the observed results of the protocol. 

Alice has no way to know which pulses are from source A^ a or source A m . 
But she knows which pulses are from source A^ and which ones from A^. We 
shall show that she can know an upper bound of the fraction of tagged bits 
from source A^ c by watching the counting rate of source A^. 

We denote the counting rates for source A^ and source A^ by S^, respec- 
tively. These values can be observed directly: 

S, = S, = (227 ) 

Np, N^i are number of pulses sent out from source A^, A^i respectively; n^, n^i 
are number of clicks of Bob's detector corresponding to pulses from A^, A^i 
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respectively. According to equation (224), we have the following equation: 



u /2 e _At ' 

= e'^'so + n'e^si + d s c + ds d . (228) 

p z e~' M 

Here we denote s , s x for the counting rates of vacuum pulses and single- 
photon pulses from A^, i.e. source A^q and A^\ , respectively, s c for counting 
rate of p c pulses from A^i, i.e., source A^ c and s d for counting rate of p d 
pulses from A^, i.e., source A^ d . Given the fact s > 0, s x > and > 0, 
we transform eq(228) into an inequality for the upper bound of s c : 

sc < -^w—rS,, (229) 

This is the bound value for counting rate of source A^/ c . This is also the 
bound value for pulses from any source that produces p c states only, including 
the source A^, i.e., those p c pulses from source A^. Therefore we have the 
following upper bound for the fraction of tagged bits for source A^. 

A < . (230) 

and we have used 

A = (231) 

In the normal case that there is no Eve's attack, Alice and Bob will find 
S^'/S^ = = p' / ^ in their protocol therefore they can verify A < , 

which is just eq.(13) of Hwang's work[140]. 

The above is the main result of Hwang's work. We have simplified the original 
derivation given by Hwang [140]. In short, Hwang's protocol works in this way: 
By watching the counting rate of decoy state (intensity //), we can obtain A 
value for the signal state (intensity p). 

Remark: Here a tricky point is that Eve cannot treat the pulses from A^ a 
and the pulses from A^ a (a = 0, l,c) differently although she can treat the 
pulses from A^ and the pulses from A^i somehow differently. Lets consider a 
similar classical story. There are professional basketball players and football 
players. We mix them and let them pass through a gate controlled by Eve. 
Eve knows that each one must be either a basketball player or a football 
player. Eve can partially distinguish each one's profession by his height: the 
taller ones are more likely to be basketball players. She can then produce a 
different transmission rate for the two types of players. For example, if she 
wants football players' transmission rate to be higher, she only needs to block 
all those taller guys. Consider a subgroup of football players Gf and subgroup 
of basketball players GV People in these subgroups are all in the same hight, 
1.80 m. Eve cannot treat people in these two subgroups differently according 
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to his profession. Say, given whatever strategy Eve may have used, if x% of 
guys in group Gf are blocked, there must be also x% guys in subgroup Gb 
being blocked. Here, all football players and all basketball players are in the 
same role of pulses from source and pulses from source in the decoy- 
state protocol. Players in subgroup Gb or subgroup Gf only are in the same 
role of pulses from source A^ or source A^i a in the decoy-state protocol. 

4-3.2 The issue of unconditional security 

The security of Hwang's method is a direct consequence of the separate prior 
art result of ILM-GLLP[154] therefore a separate security proof is not nec- 
essary. ILM-GLLP[154] have offered methods to distill the unconditionally 
secure final key from raw key if the upper bound of fraction of tagged bits 
is known, given whatever imperfect source and channel. Decoy-state method 
verifies such an upper bound for coherent-state source. We can consider an 
analogy using the model of pure water distillation: Our task is to distill pure 
water by heating from raw water that may contain certain poison constitute. 
Suppose it is known that the poison constitute will be evaporated by heating. 
We want to know how long the heating is needed to obtain the pure water 
for certain. If we blindly heat the raw water for too long, all raw water will 
be evaporated and we obtain nothing. If we heat the raw water for too short 
a period, the water could be still poisonous. "ILM-GLLP" finds an explicit 
formula for the heating time which is dependent on the upper bound of the 
fraction of poison constitute. They have proven that one can always obtain 
pure water if we use that formula for the heating time. However, the formula 
itself does not tell us how to examine the fraction of poison constitute. "Decoy- 
state" method is a method to verify a tight upper bound of the fraction of the 
poison constitute. It is guaranteed by the classical statistical principle that 
the verified upper bound by "decoy-state method" is (always) larger than the 
true value. Using this analog, the next question is how to obtain a tighter 
upper bound: if the verified value over estimates too much, it is secure but it 
is inefficient. 

Hwang's result is a large step towards the efficient and secure QKD with exist- 
ing setup. However, the result can be further improved for efficient application 
in practice. The estimated A value here is still too large. Given such a value, 
one cannot obtain a meaningful key rate in practice for long distance QKD 
with existing setups. We want a faithful and tighter estimation. We want a 
way to obtain a value that is only a bit larger than the true value in the nor- 
mal case that there is no Eve (for efficiency) , and it is always larger than the 
true value in whatever case (for security). The improved result of a tightened 
estimation of A including both the analytical formula in the asymptotical case 
and the numerical calculation in the non-asymptotic case are then given by 
Wang[141] and later confirmed and further studied by others[156]. 
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4-3.3 Improved decoy-state method 



The improvement is possible because Hwang's method has not sufficiently 
used the information of counts from different intensities. Actually, in doing 
the verification, Alice has only used the counting rate of one intensity, the 
source A^>. It should be interesting to consider the case that Alice uses more 
intensities and considers the observed results jointly. 

The decoy-state method is not immediately useful in practice until the more 
tightened estimation is given[141]. There[141], the counting rates of different 
intensities are treated jointly with non-trivial inequalities through the density 
operator convex technique. Quantitative results including both explicit for- 
mulas and numerical results are also given [141]. There [141], for the first time 
an explicit formula for the tight upper bound of A is given and the statistical 
fluctuation is studied with detailed numerical results are presented. Earlier, 
a review on Hwang's result with some rough ideas were presented [157]. How- 
ever, there is no quantitative result though it proposed to use vacuum to test 
dark count and very weak coherent state to test single-photon counting rate. 
Naturally, one can expect a higher key rate if one uses more intensities. The 
key rate in the limit of using infinite intensities is studied in [142]. 

Here we are most interested in a protocol that is practically efficient. Obviously, 
there are several criteria for a practically efficient protocol. 1. The protocol 
must be clearly stated. For example, there should be quantitative description 
about the intensities used and quantitative result about the verification. Be- 
cause we need the explicit information of intensities in the implementation 
and the explicit value of A for key distillation. 2. The result of verified value 
A should be tight in the normal case when there is no Eve. This criterion is to 
guarantee a good final key rate. 3. It should only use a few different intensi- 
ties. In practice, it is impossible to switch the intensity among infinite number 
of different values. 4. It should be robust to possible statistical fluctuations. 
Note that the counting rates are very small parameters. The effects of possible 
statistical fluctuations can be very important because the repetition rate of 
any real system is limited hence we cannot assume too large the number of 
pulses. 

Concerning the above criteria, tightened estimation of A value is then obtained[141] 
through jointly using the information of counting rates of 3 intensities, vac- 
uum, /i and /i'. We call this protocol as 3-intensity protocol [141]. For conve- 
nience, we shall always assume 

p! > n\ n'e-* 1 ' > iuT* (232) 

in this paper. Since we randomly change the intensities among 3 values, we can 
regard it as a mixture of 3 sources. Source A that produces vacuum pulses, 
source that produces coherent-state pulses of intensity /i and source A^i 
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that produces coherent-state pulses of intensity fj/. States from source and 
A are given by Eq.(222) and Eq.(224), respectively. In the protocol, they can 
directly watch the counting rates of each source of A , A, Ayj as we have stated 
before, i.e., S^S^i are shall be regarded as known parameters. Suppose they 
find Sq, Sp, for each of them. In the asymptotic case, we have the following 
equations: 

S fl = e'^So + /ie-^si + cs c (233) 

S = e^'So + t/e-n's! + c^—-s c + ds d (234) 

In the above we have used the same notations So, Si, s c in both equations. This 
is because we have assumed that the counting rates of the same state from 
different sources are equal. So, S M , are known, si and Sd are unknown, but 
they are never less than 0. Therefore setting Sd, si to be zero we can obtain 
the following crude result by using Eq.(234) alone. 

cs c < (S> - e^'So - fjfe-^'si) . (235) 

Since s\ > 0, we obtain a crude result for the upper bound of s c 

cs c < J^£L (S, - e-*S ) . (236) 

However, we can further tighten the verification by using Eq.(233). Having 
obtained the crude result above, we now show that the verification can be 
done more sophisticatedly and one can further tighten the bound significantly. 
In obtaining inequality (236), we have dropped terms s\ and Sd, since we 
only have trivial knowledge about Si and Sd there, i.e., s\ > and Sd > 
then. Therefore, inequality(236) has no advantage to Hwang's result at that 
moment. However, after we have obtained the crude upper bound of s c , we can 
have a larger-than-0 lower bound for si by Eq.(233), provided that our crude 
upper bound for s c given by Eq.(236) is not too large. Combining the crude 
upper bound for s c given by Eq.(236) and Eq.(233), we have the non-trivial 
lower bound for s\ now: 

si > S M - e-^So - cs c > 0. (237) 

With this new lower-bound of S\, we can further tighten the upper-bound of 
s c by Eq.(235) and obtain a more tightened s c . With the new s c , we can again 
raise the lower bound of S\ by Eq.(233). The final bound values are determined 
by infinite iterations. Therefore tight values for s c and Si can be obtained by 
solving the simultaneous constraints of equation (233) and inequality (235). 
We obtain 

a'S — a c S' a\S — aiS' 
si > —, s c < -7 — (238) 

Qi\(l c — CL^CL C CL-^CL C — (X\(l c 
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and S — Sp — e ^Sq, S' = — e ^ So, a± = fie ^, a[ = fi'e M ', a c = c, a' c 



Given these, we can easily find the lower bounds and upper bounds 
for the fraction of untagged bits and tagged bits for both intensity /i and fi'. 
In general, raw bits caused by both intensities can be used for the final key 
distillation. For the intensity /i, we have 

ue~^Si cs c , 

Ai = A = (239) 

for the fraction of untagged bits and tagged bits, respectively; for the intensity 
fjf, we have 

Ai = A' = ^ (240) 

for the fraction of untagged bits and tagged bits, respectively. For example, 

A<^(^-l)+^. (241) 
fi' - fi \fi'e ^ Sf, J n'Sp 

Also, through the fact of 

A + Ai + A = 1 (242) 

we have 

Ai = 1 — A - e-"a /^ (243) 
and Ao is the fraction of vacuum counts. In the case of so << rj, if there is no 
Eve, SU Sfj, = fi'/ fi. Alice and Bob must be able to verify 



fi, I " M 



fi' — fi 



= fi (244) 

H'-H-tO 



in the protocol. Of course, other parameters such as A' x , A' can also be calcu- 
lated explicitly by Eq. (238,240). Given these, we can distill the final key from 
both intensities. The values of fi, fi' should be chosen in a reasonable range, 
e.g., from 0.2 to 0.6. Actually, we can distill more final bits from raw bits 
created by intensity fi' than that of fi, we shall call pulses of intensity fi' as 
the signal pulses and pulses of intensity fi as decoy pulse for simplicity. 

Summary: The 3-intensity decoy-state protocol is stated by the following: Alice 
switches the intensity of each pulses randomly among 3 values, 0, fi ~ 0.2 
and fi' ~ 0.5. Suppose she sends out N pulses of intensity 0, iV M pulses of 
intensity fi and pulses of intensity fi'. Bob then announces which pulses 
have caused a click. According to Bob's announcement, Alice knows that the 
pulses of intensities 0, fi and fi! have caused riQ,n^,n^i clicks at Bob's side. 
Alice uses So = f^, S^ = jf- and S^i = jf^ as the input of eq.(241) and obtain 

the value A. She can also obtain the value of other parameters such as A', A 1; 
and A' x based on this. Raw bits caused by both intensities of fi and fi' can be 
used for the final key distillation, if the key rate is larger than 0. 
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4-3.4 Statistical fluctuations 



The results above are only for the asymptotic case. Before applying the decoy- 
state method in practice, we must first resolve the very important security 
problem related to the statistical fluctuation. In practice, the number of pulses 
are finite thus there are statistical fluctuations, i.e., Eve has non-negligibly 
small probability to treat the pulses from different sources a little bit differ- 
ently, even though the pulses are in the same state. This problem was first 
proposed and solved in [141] and then further studied[156,158]. Mathemati- 
cally, this can be stated by 



and the real number r a is the relative statistical fluctuation for s a , a = 0, 1, c. 
It is insecure if we simply use the asymptotic result in practice. Since the 
actual values are actually different from what we have estimated from the 
observed data. Our task remaining is to verify a tight upper bound of A and 
the probability that the real value of A breaks the verified upper bound is 
exponentially close to 0. 

The counting rate of any state p from different sources now can be slightly 
different with a non-negligible probability. We shall use the primed notation 
for the counting rate of any state from source A p i and the original notation 
for the counting rate Of any state from source A. Explicitly, constraints of 
Eq(229,237) are now converted to 



for a = 0, 1, c. For security, we need to seek the worst-case solution of s[ or s' c 
of the above equations over all possible r a . As shown in ref[161], the maximum 
values of {r a } lead to the smallest solution of s[ or largest solution of s' c in the 
equations above. What is the reasonable largest value of r a ? We can figure 
out the issue by classical statistics. We regard r aM as the upper bound of r a 
if the probability that r a > r aM is exponentially close to 0. 

Given N1+N2 copies of state p, suppose the counting rate for N\ randomly cho- 
sen states is s p and the counting rate for the remaining states is s' p , the proba- 
bility that \s p — s' p \ > 5 P is less than exp (— O5 p 2 N /sp) and iVo = Min(Ai, A 2 ). 
Now we consider the difference of counting rates for the same state from differ- 
ent sores, A and A p i . To make a faithful estimation with exponential certainty, 



s a (p) = (1 +r a )s a (p') 



(245) 




(246) 



with setting 




(247) 
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we require S P 2 N /s p = 100. This causes a relative fluctuation 



T ^ 7/- 10 /5' (248) 

The probability of violation is less than e~°^ 100 \ To formulate the relative 
fluctuation r±,r c by s c and s±, we only need to check the number of pulses 
in states p c , |1)(1| in each sources in the protocol. That is, using eq.(248), 
we can replace ri,r c in eq.(246) by 10e M / 2 y^j-^, 10-y/^y, respectively and 
N is the number of pulses in source A. With these inputs, eq.(246) can now 
be solved numerically for the largest value of s c in the likely range of sta- 
tistical fluctuation, i.e., the fluctuation beyond the assumed range is in the 
magnitude order of e-°( 100 ). Good numerical results for a tighten estimation 
of A value have obtained [141] by many parameter settings based on existing 
technology[121,122]. For example, given /i = 0.3, // = 0.43, and r\ = 10~ 3 , we 
obtain A = 34.4% which is greatly less than Hwang's asymptotic result 60.4%, 
though it is still a bit larger than the true value, 25.9%. Definitely, we can 
also replace s a by s' a (l + r a ) (a = 0, 1, c) in Eq.(246) and then find out the 
worst-case result for s' c numerically. The fraction of multi-photon counts 
for pulses of intensity // have also been tightly verified [141]. 



4-3.5 Robustness with respect to small errors 

We now study how robust the method is. In the protocol, we use different 
intensities. In practice, there are both statistical fluctuations and small op- 
erational errors in switching the intensity. We shall show that, by using the 
counting rates of 3 intensities, one can still verify tight bounds even we take 
all theses errors and fluctuations into consideration. 

There are small operational errors inevitably. Say, in setting the intensity of 
any light pulse, the actual intensity can be slightly different from the one we 
have assumed. There are also fluctuation to the photon number distribution 
for each intensities[159]. 

At any time Alice decides to set the intensity of the pulse to be fi or //, the 
actual intensity could be /ij, which can be a bit different from p or fi'. 
The intensity errors of different pulses can be correlated. Due to this possible 
correlation, neither the decoy pulses nor the signal pulses are independent, the 
state of decoy pulses or signal pulses cannot be simply represented by a single- 
pulse density operator as described by Eq.(218). With the correlated intensity 
error, the pulses from class A m and class A^a (a = 0, l,c) are actually not 
randomly mixed in the protocol as shown below therefore the conditions for the 
propositions of decoy-state method are not satisfied. For example, the intensity 
can be dependent on the temperature. In a certain interval, all pulses can be 
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brighter or darker than the supposed value. Consider an extreme example. 
Suppose the actual intensity of each pulse is 10% larger than the supposed one 
in the first half of quantum-state transmission, 10% lower than the supposed 
one in the second half of the transmission. If Eve's channel transmittance is 
4t during the first half of pulse transmission and t during the second half of 
pulse transmission, s\, the counting rates of pulses from source A^i and s[, 
that of class A^i can be calculated by: At ^^^'kxofaf-o^ with the setting 
of x = /i, «' '. For fi = 0.2, u' = 0.6, we find s\ = 1.023^ rather than Si = s[. 
This has clearly shown that Proposition 2 cannot be blindly used because 
here because A^i and A^i are not randomly mixed, although they contain 
the same quantum states. The "randomly mixing" condition for two sources 
A m , A^ a requires the following condition: For any pulse sent out from Alice, 
if it belongs to A^a U A^> a , the probability that the pulse belongs to A^a and 
the probability that the pulse belongs to A^i a must be constant throughout 
the quantum communication stage of QKD. But the correlated intensity error 
can violate this requirement. 

The problems listed above can be overcome in various ways[160,161,162]. First, 
there is a theory[160] for whatever error pattern provided that the largest 
intensity error of a single pulse is not too large. But in such a case, the final 
key rate drops drastically with the intensity error. As is shown in Ref.[161], if 
the intensity errors are random and independent, even though there are large 
errors, such as 20% fluctuation, the key rate is almost the same with the ideal 
case where the intensity is controlled exactly. The efficiency becomes quite 
good here because the linear terms of the fluctuation disappear and only the 
quadratic terms of the fluctuation take effect in the protocol. To make sure 
that the intensity error of each pulse is random, we can use, for example, the 
feed forward control demonstrated under another topic [163]. If we are not sure 
of the error pattern, we can also use the method proposed in Ref.[162], where 
we request that at each time, a father pulse is produced and then attenuated by 
a two- value attenuator to create a decoy pulse or a signal pulse. This method 
works for whatever error pattern and also the key rate is quite good. Say, if 
the intensity error is bounded by 5%, to reach the same key rate of the ideal 
protocol, the distance given by the method of Ref. [162] is only 1 km shorter 
than that of the ideal protocol where pulse intensities are controlled exactly. 

Due to the small operational error, the intensity of light pulses in source Aq 
could be slightly larger than 0. This doesn't matter because a little bit over 
estimation of the vacuum count will only decrease the efficiency a little bit but 
not at all undermine the security[161]. (Eq.(241) shows that overestimation 
of dark counts will lead to overestimation of A value.) Therefore we don't 
care about the operational error of this part. Say, given no counts for all 
the pulses from source Aq, asymptotically, we can simply assume the tested 
vacuum counting rate to be so = n /N Q , though we know that the actual value 
of vacuum counting rate is less than this. 
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4-3.6 Final key rate and further studies 



Given the methods to verify A, the upper bound of fraction of tagged bits or 
Ai, the lower bound of fraction of untagged bits, we can calculate the final key 
rate by Eq.(217). However, there are more efficient formulas. As it is pointed 
out in Ref[142], actually, one need only correct the phase-flip errors of single- 
photon counts and remove tagged bits for privacy amplification. In particular, 
the following formula is recommended [142, 156] for key rate of any intensity x: 



Qi(x) = Ai(x) + A (x) - H{E{x)) - A 1 (x)i/(e 1 ). (249) 



Here Ai(x) and Ao(x) are fractions of single-photon counts and vacuum counts 
respectively for the intensity x which can be either \x or //; E(x) is the observed 
error rate of bits caused by source A x and t\ is the error-rate of counts caused 
by single-photon pulses. This formula gives a higher key rate than that of 
Eq.(217). Given A value or Ai(x) value, t\ can be estimated efficiently. We 
only need to derive the e\ value. We can do so by using the weaker source[156], 
intensity /i. Obviously, if the observed total error rate is E(f/) for source fj,, 
then e\ can be calculated by 



ei = t ; \ ■ (250) 



After the major works presented in[140,141,142], the decoy-state method has 
been further studied[158-171,277]. For example, Harrington et al. [159] numer- 
ically studied the effect of fluctuation of the state itself. Ref. [158] proposed a 
4-state protocol: using 3 of them to make optimized verification and using the 
other one fi s as the main signal pulses. This is because, if we want to optimize 
the verification of A value, /i, // cannot be chosen freely. Therefore we use 
another intensity fi s to optimize the final key rate. It is shown numerically 
on how to choose the intensity for the main signal pulses (fi s ) and good key 
rates are obtained in a number of specific conditions. The results of final key 
rates [141, 158] show that good key rate can be obtained even the channel trans- 
mittance is around 10~ 4 . There are even improved formulas for a higher key 
rate[164,165]. This corresponds to a distance of 120-150 kilometers for prac- 
tical QKD with coherent states. Using two-way classical communication [148] 
in the final key distillation can further increase the QKD distance [166]. The 
theory of decoy-state has now been extensively demonstrated by a number of 
experiments[167,168,169,170]. The decoy-state method also applies to other 
types of source, e.g., the parametric-down-conversion source[171]. 
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4-3.7 Summary 



Given the result of ILM-GLLP[154], one knows how to distill the secure final 
key if he knows the fraction of tagged bits. The purpose of decoy state method 
is to do a tight verification of the the fraction of tagged bits. The main idea 
of decoy-state method is to use different intensities of source light and one 
can verify the fraction of tagged bits of certain intensity by watching the the 
counting rates of pulses of different intensities[140]. With the mathematical 
technique of density operator convex and jointly treating the counting rates 
of different intensities with non-trivial inequalities[141], the upper bound of 
fraction of tagged bits or the lower bound of the fraction of untagged bits can 
be verified so tightly [141] that the decoy-state method is immediately imple- 
mentable with the existing matured technology. Since the counting rates are 
small quantities, and in any real setup, the number of different intensities and 
pulses are limited, the effect of statistical fluctuation is very important [141]. 
It has been shown that the decoy-state method can work in practice even with 
the fluctuations and other errors[141]. If one uses infinite number of different 
intensities and each intensity consists of infinite pulses, one can actually verify 
the A value perfectly [142]. The decoy-state method has promised a distance of 
120-150 kilometers for practical QKD[141,158]. To further raise the distance, 
we need to improve the existing technologies, this includes decreasing the dark 
counts, raising the detection efficiency and the system repetition rate. 

Remark: Although decoy-state method is promising for the practical quantum 
key distribution, it is not the only choice. Other promising methods for prac- 
tical QKD include the method using strong reference light [144], the mixed 
B92 protocol[143] (i.e., SARG04 protocol ), and so on. For those earlier pro- 
tocols and implementations, one may refer to the excellent review on QKD 
presented by Gisin, Ribordy, Tittle and Zbinden[13]. For a review of most 
recent developments of QKD theory, one may refer to Ref[172]. 



44 SARG04 protocol 



This protocol wa proposed by Sacrani, Aci, Rigbord and Gisin in 2004 [143], 
and is called SARG04 protocol. The protocol uses BB84 states but the bit 
value of each qubit is represented by its preparation basis, say, Z basis for 
and X basis for one. Consider the B92[144] protocol first. Alice may send 
Bob either state |0) in Z basis or state |+) in A basis. Bob will measure each 
qubit in either X basis or Z basis and he has a probability 1/4 to obtain a 
conclusive result. For example, suppose Alice has sent him a state |0). If Bob 
measures it in Z basis, he will be surely obtain |0) and they will discard this 
data, because both |0) and |+) can lead to this result and Bob does not know 
whether the bit value is or 1. However, if he measures it in X basis, he could 
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obtain a conclusive result. If he obtain |+), they will discard the data because 
Bob does not know the bit value. But if he obtain |— ) which is orthogonal 
to |+), Bob concludes that the qubit must have been prepared in state |0) 
by Alice. In summary, Bob changes his measurement bases between Z and X 
randomly and those measurement results of 1 1) and |— ) indicate conclusive 
bit values. They will only use those conclusive bit values. 

There is a security drawback of B92 protocol given a lossy channel, though it 
is unconditionally secure if the lossy rate is lower than certain threshold [173]. 
Obviously, if the channel transmittance is less than 1/4, it cannot be secure 
because Eve may measure each qubit in the middle in either Z or X, with 1/4 
probability, she obtains a conclusive result and she re-produces Alice's state 
and sends it to Bob through a transparent channel; with 3/4 probability the 
result is inconclusive, she blocks it and pretends her action to be channel loss. 

SARG04 has developed the B92 protocol and avoided the above drawback. 
SARG04 uses 4 states which are just the BB84 states. Bob will just measure 
each qubits in either Z basis or X basis. Then, Alice announces a set of two 
states for each qubits. There are 4 possible sets, S 0+ = {|0), |+)}, Sq~ = 
{|0), |-)}, S 1+ = {|1), |+)}, Si- = {|1), |-)}. Each BB84 qubit must belong 
to at least one set in the above. Alice just randomly chooses a set that contains 
the state of that qubit. After Alice's announcement of a specific set for each 
qubit, Bob knows which of his data corresponds to the conclusive results. 
Explicitly, whenever Bob obtains an outcome state that is orthogonal to one 
of the two states in Alice's announced set, he has obtained a conclusive bit. 
And they discard the other data. 

One obvious advantage of the SARG04 protocol is that it does not change the 
physical set-up of BB84 at all therefore can be immediately used in practice. 
And, not only has it overcome the drawback of B92 protocol itself, but also it 
is secure under the PNS attack even we use weak coherent light with a very 
lossy channel. For example, we consider the case that the pulse contains 2 
photons. In this case Eve can split the pulse and keep one photon. Suppose 
the actual state is |0) and later Alice announces a set S 0+ . Suppose Bob has 
happened to obtain a conclusive result. In such if Eve also measures 

it in a basis randomly chosen from X, Z, Eve only has a possibility of 1/4 
to obtain a conclusive result. In the normal realization of BB84 with one 
intensity of coherent light, Eve can obtain all information of Bob's raw key 
by the PNS attack. But the same attacking scheme may only allow Eve to 
be sure of 1/4 of Bob's raw key in the SARG04 protocol. Of course, Eve may 
have many other choices[174]. However, as it has been shown by Koashi[175], 
given whatever Eve may take, the SARG04 protocol with weak coherent light 
is always secure with a net final key rate at least in the magnitude order of 
0(rf/ 2 ). Moreover, if we increase the number of possible bases, the key rate 
can be further raised[175]. 
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4-5 QKD in position-momentum space 



In principle, BB84 protocol of quantum key distribution is secure because it 
uses 2 bases and measurements in these two bases do not commute. By the 
uncertainty principle, if Eve looks at the transmitted qubits in whatever ba- 
sis, she must cause noise to thoses qubits prepared in another basis. The key 
point here for security is the noncommunity of two bases. Therefore, secure 
QKD should not be limited to quantum states in two-level space such as po- 
larization and phase coding. It should also allow protocols with quadrature 
measurements of continuous variables, for example, the position and momen- 
tum. For simplicity, we shall call any quadrature observable as position x and 
momentum p provided that they satisfy the same commutation relation. 

Basically, Alice can encode the bit values in either position or momentum. If 
Eve looks at the bit values in position basis, she must cause noise to the infor- 
mation in momentum basis, and vice versa. There have been a number of pro- 
tocols for QKD in position-momentum space[176, 127,177,178, 179,180, 181, 182,183, 184,185,186]. 
All these protocols encode the bit values by Gaussian states, more specifically, 
coherent states or squeezed states. Most of the studies about the security are 
limited to the individual attack while the effects of collective attack is rarely 
discussed [187]. The only unconditional security proof uses one-mode or two- 
mode squeezed states based on the idea of purifying the encoded two-level 
entangled pairs[145]. Here we shall first review the protocols with coherent 
states and squeezed states, and then go into the unconditional security proof. 



4-5.1 Protocols of QKD with Gaussian states 
A. Protocols with coherent states. 

We can take two types of displacement on a coherent state, say, position dis- 
placement e~ tx P and momentum displacement e ipx . A possible protocol works 
as follows[177]. Alice generates two random numbers and modulates these 
numbers on a coherent state by taking displacement operations in position 
and momentum respectively. Bob detects either position or momentum of each 
light pulse. By a public channel, they compare their results of those times Bob 
has measured the momentum. If Bob's results agree with Alice's in an accept- 
able rate, they would use the position value as the raw key, i.e., the results 
of the times Bob has measured in position basis. Otherwise, they discard the 
protocol. 

Consider the most intuitive Eve's attacking. To each pulse, Eve could guess 
a basis that would be used by Bob and she measures in this basis herself 
and then reproduce a coherent state with the same displacement in that basis 
and sends it to Bob. However, in average, there is 50% probability Eve makes 
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wrong guess and Bob will find large noise at those times Eve has used a wrong 
basis therefore Eve's presence will be detected according to the protocol itself. 
This is similar to the case of original BB84 protocol. 

However, Eve may do it more sophisticatedly given a lossy channel. Suppose 
the channel transmittance is only 50%. But Eve may have a channel with per- 
fect transmittance. Eve may then split each pulse by a 50:50 beam-splitter. 
She keeps one daughter pulse and sends the other one to Bob through a perfect 
channel. Bob can not detect Eve's presence because Eve has just pretended her 
action to be the channel loss. After Bob announces the measurement basis for 
each pulse, Eve measure her pulses accordingly. In such a way, Eve's amount 
of information about Alice's key is the same with that of Bob. Therefore, 
a necessary condition for such a QKD protocol with coherent state is that 
the channel loss should be less than a half [181]. However, such a necessary 
condition is only for the case of key distillation with one-way classical commu- 
nication. In this case, Bob accepts all remaining bits if the protocol passes the 
error test. However, if they use two-way classical communication, they may 
discard those bits with larger error rate and only keep those bits with smaller 
error rate[182]. This is a kind of advantageous distillation by post-selection. If 
they use this post-selection, the channel loss does not have to be less than a 
half for a secure QKD. With the method of post-selection, Alice and Bob can 
do QKD even more efficiently [185]. Bob actually doesn't have to switch his 
measurement bases. Alice draws two random numbers xa,Pa and sends Bob 
a coherent state of |a) = \xa + Wa)- Bob splits it by a 50:50 beamsplitter and 
measures one daughter pulse in position basis and the other in momentum 
basis. They use post-selection[182] to reverse any initial "information advan- 
tage" a potential Eve may have obtained and distill a final key. This type 
of QKD without bases switching has been demonstrated experimentally with 
a channel loss up to 90% [185]. Actually, if Eve only uses individual attack 
by a beamsplitter, the secure distance for QKD with coherent states is un- 
limitted, if a sufficiently large post-selection threshold is set. Some experiments 
of QKD with position-momentum measurement have been done by using the 
homodyne detection[180,185,186]. 

Beyond the framework of BB84 and its variants, Yuen's group proposed a 
key expansion scheme [188] with mesoscopic coherent states by making use of 
the noise of the states (Y-00 protocol). The security issue of Y-00 has been 
actively discussed[189,190]. 

B. Protocols with squeezed states. 

There are also proposals for QKD with displaced squeezed states of one-mode 
or two-mode, e.g., [178]. If we use squeezed states, the source noise is com- 
pressed. A coherent state has the same statistical fluctuations in the two bases. 
But a squeezed state can have a smaller noise in one basis and largere noise 
in another basis. For example [178], Alice can send displaced squeezed vac- 
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uum state to Bob, which is squeezed in either position basis or momentum 
basis. Bob measures each pulse in a basis randomly chosen from position or 
momentum. Again, the security here is a result of uncertainty relationship. 

Consider the case of infinite squeezing. Alice may either produce a random 
position eigenstate or a random momentum eigenstate. In this case, if Bob 
measures a state in the right basis, he obtains a value that is identical to 
Alice's value. Also, a position eigenstate distributes uniformly in momentum 
space, and vice versa. This means, if the state is has been measured in a wrong 
basis, it would very likely produce a wrong result if it is measured latter by 
Bob in the right basis. Alice and Bob will only use those data obtained from 
the right bases. If Eve has intercepted the state and measured it in a basis as 
she guessed and then reproduced a state according to her measurement result 
and sent it to Bob, there is 50% probability that she has caused large noise. 

In practice, infinite squeezing is not available. However, finitely squeezed states 
also have the similar property. If it is squeezed in position basis and its aver- 
aged position (momentum) is x A , then with high probability the measurement 
result falls inside a small interval centered by x A , if one measures it in position 
basis. But, if anybody measures it in momentum basis, the result would be in 
a large range. This means that Eve will cause large noise to the state squeezed 
in position basis if she measures it in momentum (position) basis. In the QKD 
protocol with finite squeezing, Alice will only use a set of discrete values as the 
averaged position and momentum for squeezed states in each basis. The states 
in the same basis with different discrete values are almost orthogonal, but the 
overlap of states between different bases are considerable. Explicitly, consider 
the squeezed vacuum state S(r) |0) and operator S(r) = expfra^ — ra 2 ]. If we 
take a displacement operation D(xa,Pa), this state will be centered at xa,Pa 
in position space and momentum space respectively. If we measure the posi- 
tion, the probability that the result falls inside the interval (xa — 5/2, xa + S/2) 
is 

fXA+S/2 

Ps = (x\p(x A ,p A ,r)\x)dx (251) 

Jx A ~5/2 

and p(xa, Pa, r) is the density operator of displacement squeezed vacuum state, 
which is squeezed in position basis and centered at xa and pa respectively 
in position space and momentum space, respectively. After calculation one 
finds[178] 

Pi =erf(^) (252) 

and v = l/2e- 2r , 

erf(x) = -= / X e~ t2 dt. (253) 

y'KJQ 

If we choose 5 to be 1/8 and r = 3.3, the probability of obtaining a wrong 
value (a value that is outside the assumed interval of S centered at xa) is less 
than 10~ 3 . However, if the measurement is done in momentum basis, the likely 
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interval will be e r /2 which is more than 100 times larger than 5. This is to say, 
whenever Eve measures a pulse in a wrong basis, she must cause large noise 
to the state therefore her presence will be detected. If they use the coherent 
states, the interval S for the right basis will become larger and the interval in 
wrong basis will be smaller. 

However, in practice, the channel can be very lossy. As it has been calculated [177], 
the effects of channel loss is rather severe. Even Alice starts from the infinitely 
squeezed state, if we want the same error probability for the same interval as 
shown above, the transmission distance in the normal optical fiber can be only 
1 km, with a loss rate of 1.2 x 10~ 6 /m. Eve may attack the protocol more ef- 
fectively by pretending her action to be the channel loss. Again, here she can 
use beam-splitter attack. As it has been shown [178], the negative effect of loss 
can be reduced by amplifiers and the method is secure against the individual 
beam-splitting attack. 

There are also proposals of QKD with 2- mode squeezed light [177, 179]. Given 
2-mode squeezed states, it is possible to make a pre-determined key [179]. The 
protocol inspects eavesdropper by checking quantum correlation of two beams, 
one with Alice and the other sent with Bob. This is the analog of Ekert 91 
protocol [147] with Gaussian entanglement. 



4-6 Security proof of QKD with squeezed states 

So far we have not considered the issue of unconditional security. It has been 
shown by Gottesman and Preskill[145] that one can do unconditionally secure 
quantum key distribution with one-mode (or 2-mode) squeezed states. To 
make the proof, they first construct the encoded 2x2 EPR pair state [84] and 
then use the similar reduction technique as used in the case of qubit-QKD by 
Shor and Preskill[138]. (Definitely, one can also use the method in section 4.1 
for final key distillation.) As a result, QKD with one-mode squeezed state is 
unconditionally secure under whatever type of eavesdropping. 



4-6.1 Security proof of QKD in position-momentum space. 

As we have mentioned in section 2.5, we can use encoded 2x2 EPR state in 
position-momentum space 

l0 + ) = -^(|OO) + |ll)) (254) 

and 
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|0) oc \ x = 2s Vn) oc^2\p = s^/n); 

— oo — oo 

OO OO 

|1) oc ^ \x = {2s + 1)Vtt) oc ^(-l) s |p = sv 7 ^)- (255) 

— oo — oo 

Here we have bit-flip operator 

a x = (256) 

which causes a bit-flip of |0) — > |1); |1) — > |0); phase-flip operator 

a, = e*^ (257) 

which causes a phase-flip of |0) — > |0); |1) — > — If Alice starts with such 
states and then do entanglement purification as if they were two-level states, 
they can obtain the secure final key. More explicitly, Alice sends half of each 
pair to Bob. They will measure e t2y ^ x and ^- %2 ^v to determine the values of 
x or p modulo yfn and then add a displacement to the state to adjust it to 
the nearest integer multiples of \/tt. The noisy channel could have shifted a 
few states to an extent that it has a wrong nearest integer multiples of t/tt. 
Such errors can be removed by entanglement purification in the encoded space 
space, if the error rate is not too high. In particular, they can measure e % ^ x to 
see whether the position of the state is an even (bit value 0) or odd (bit value 1) 
multiples of y/n, or measure e~ 1 ^^ to see whether the momentum of the state 
is an even (bit value 0) or odd (bit value 1) multiples of \pii. Furthermore, 
they can directly measure x or p to conclude the bit value equivalently. In 
short, to do the secure QKD in position-momentum space with the encoded 
EPR states, Bob shifts his state according to the value announced by Alice 
and then together with Alice purifies the entanglement in the decoded space. 
Similarly, Alice may produce any displaced EPR state in the form 

d p )) = [/ ® D(^d x , ^d p )] ^(|00) + |11)). (258) 

Here the displacement operator D is defined in Eq.(35). After she sends the 
displaced parts to Bob, Bob measures x or p modulo y/n. Alice then announces 
the displacement d x or d p and Bob takes the reverse displacement to his states. 
On the other hand, it makes no difference if Alice measures her part in the 
beginning, before she sends anything to Bob. Thus, Alice need only prepare 
displaced encoded BB84 states in D(y/Trd x , y/irdp)(\0), 1))} space and sends 
them to Bob. Suppose she prepares N + m states among which N are prepared 
in {|0), |1)} basis and m are prepared in D(y/nd x , \/^d p ){-^ (|0) ± |1))} basis. 
Bob measures each of them either in position or momentum space and they 
will discard the data with basis mismatch. Also, Bob will revise his data by 
classical information of d p or d x from Alice. In particular, if Bob measures 
x, he does not need phase information, i.e., d p , therefore Alice does not have 
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to tell him this. This means Alice can actually choose a random value of 
< dp < 2y^u. Thus, if Alice decides to send Bob a displaced |0), she can 
actually sends him 

{ e i ^e" i ^ ?5 |0)(0|e i ^ ?5 e- i ^d?/. (259) 
Jo 

If we write it in position space, the factors for off diagonal terms are all after 
integration and the state is actually 

p(d x ,z = 0) = J2\ X = (2s + d x )V^){x= (2s + d x )V^\- (260) 

s 

Similarly, if Alice wants send Bob a state in position basis with bit value 1 
and displacement d x , she only needs to directly prepare the following state for 
Bob 

p(d x ,z = 1) = J2\ X = (2s+l + d x )^)(x= (2s + l + 4)v^l- (261) 

s 

Averaged over all possible displacement < d x < 2-^7?, Alice only needs to 
send random position states ! Due to the same reason, for those states in basis 
of states displaced from 77^ (|0) ± |1)), she can actually uses arbitrary momen- 
tum states. Therefore, the protocol actually only requires Alice to prepare 
random position states and random momentum states. A state with explicit 
position or momentum is not available in practice because it requires infinite 
energy. But one can prepare (finitely) squeezed states in either position space 
or momentum space. Such an imperfect source means excessive channel noise 
even they have a noiseless channel. However, as we shall show it later [145], if 
the initial state is sufficiently squeezed, the bit-flip error rate can be still less 
than 11% and one can distill some final key. 

Remark. In the security proof above, the EPR state in the encoded subspace 
is used as a mathematical tool. However, such type of encoded EPR state 
is unnormalizable. It should be interesting to seek alternative proofs which 
circumvents such unnormalizable states. 

4-6.2 Realization with squeezed states 

As we have pointed it out already, the infinitely squeezed states (position or 
momentum eigenstates) are unavailable since these states are un-normalizable. 
In practice, highly squeezed states would be quite technically demanding. An 
interesting question is the minimum squeezing demanded for the protocol with 
squeezed states. Say, if the source is not perfectly squeezed, there are errors 
due to the source itself. Also, the position x and momentum p should be 
always finite. A related question is how to choose the probability distribution 
of position and momentum. The perfect encoded BB84 states cannot be used 
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here because this means that with large probability that p, x should be very 
large. We want to reduce the protocol to the realistic case that the probability 
of using large position or momentum state will be negligibly small for large. 
This is indeed the case by a further examination of the security with a noisy 
source. 

In the entanglement distillation, it is only the error rate of the shared raw 
pairs that matters. The final key rate does not depend on how the errors of 
the shared raw pairs had been generated e.g., source error or transmission 
error, it only depends on the value of the error rate of those shared raw pairs. 
Alice and Bob need test the error rate of the shared pairs and then carry out 
the distillation protocol. Moreover, for the purpose of QKD, it doesn't matter 
if Alice measures her qubits in the very begining, i.e., the purification protocol 
is equivalent to a prepare-and-measure protocol with (noisy) bipartite states. 

As shown in Ref[145], we can make a secure protocol with two-mode squeezed 
states or directly produce single-mode Gaussian state which can also be pro- 
duced from a bipartite state in principle. 

We consider the case that Alice initially creates a two-mode Gaussian state in 
the form 



WA)> 



AB 



—j= [ dx^dx^exp 
\A J 



1_ A 2 f XA+£B_ y 



x exp 



1 (x A - x B \ 



x exp 
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dpAdps exp ■ 

1 [Pa+Pb^ 



) /A 2 



x A , x B ) 

2 



1 A 2 ( Pa ~ Pb \ 

2 V 2 



J 



/A 2 



\pa,Pb) 



(262) 



where A is real and positive. In the case Alice measures position and obtain 
xa, she has prepared the following one-mode squeezed state for Bob: 



B 



(ttA 2 ) 1 ^ 



dxB exp 



-Xxb -x B0 ) 2 /A 2 



\x B ) 



(263) 



and 



and 



xbo 



1 + 



A 



X A 



1-A- 1/2 



X A 



1 + ■ 



(264) 



(265) 



The probability distribution for the outcome of Alice's measurement can be 
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expressed as 



P{x A ) 



A 



exp (-A 2 x 2 A) 



(266) 



and we can easily see that if Alice and Bob both measure x, then the difference 
of their outcomes is governed by the probability distribution 



Prob(xA — xb) 



1 



V 71 A'- 



exp[-(x A - x B ) /A ] . 



(267) 



Also, if Alice measures her pulse in momentum space, she will have a proba- 
bility distribution of 



p(pa) = ^ exp (-Ay A 



(268) 



where A 2 



1 ^.4 A 4 • If she obtains p A , she has prepared the state 



MM) 



B 



(7rA- 2 )V4 



dxs exp 



\{PB 



PBO) 2 ^ 



(269) 



and 



p B o= \l-Af) l/2 p A - (270) 
We now ignore the noise due to channel and take a look at the the error rate 
due to the finite squeezing of the source. If \xa — xb\ < Alice and Bob 

still share the same bit- value since the bit- value is determined by the nearest 
integer of multiples of y/ir. However, if \xa — xb\ > there will be a 

bit-flip error. Therefore the bit-flip error rate caused by the imperfect source 
is 



2A 

P(\x A -x B \ > y/n/2) < exp(-7r/4A 

7T 



(271) 



If A < 0.486, the error rate from the source is less than 1% which is sig- 
nificantly below the threshold value 11%. We also have the similar result for 
bit-flip error rate in momentum space. The effect of channel loss and other 
imperfections can also be studied in a similar way [145]. 

Also, it makes no difference if Alice directly prepares the single-pulse states for 
transmission rather than first preparing bipartite states and then measuring 
her pulse in BB84 basis, if the directly created single-pulse state is identical to 
that of half of bipartite state. This is to say, Alice can obtain secure final key 
even she uses a noisy single-pulse source which produces po,i,+ - as the noisy 
BB84 states, provided that in principle there exists a bipartite pab which has 
the following property: If we measure photon A of pab in Z basis and obtain 
|0) or |1), state for photon B will become po or Pi accordingly; if we measure 
photon A in X basis and obtain |+) or |— ), state for photon B will become 
p + , p_ accordingly. Explicitly, we have the following final protocol for QKD 
with squeezed states[145]: 
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1: Alice sends a number of displaced squeezed states to Bob. Most of her 
states are squeezed in position. For those position squeezed state, Alice 



then sends Bob these states. 
2: After receives the states, Bob measures each one in either position basis or 
momentum basis. 

3: Bob announces his measurement basis for each state. Alice asks him to 
discard those data from a wrong basis. 

4: Alice announces the value x, modulo y/n. Bob subtracts Alice's value from 
his own measured value, and corrects to the nearest integer multiple of y/n. 
Bob and Alice extract their shared bit according to whether the integer is 
an even number or an odd number. 

5: They then do the error test in two level space. If the error rates are not too 
large they go on to do the final key distillation, otherwise, they abort the 
protocol. Bob announces bit values of all those bits obtained from measure- 
ment in momentum basis and the same number of bit values from position 
basis. The remaining bits are all from position basis. They distill the final 
key by the method in section 4.1, including error correction and privacy 
amplification. 



5 Mathematical theory of quantum entanglement with Gaussian 



In this section, we review the entanglement properties of Gaussian states of ra- 
diation fields. Firstly, we introduce a notion of quantum entanglement with its 
basic properties - separability and distillability in Section 5.1, where we note 
that the partial transposition plays a key role in the entanglement theory. Sec- 
ondly, in Section 5.2, we review the entanglement properties of Gaussian states 
focusing on the qualitative aspects. These properties include the description 
of partial transposition of Gaussian states, necessary and sufficient conditions 
for the separability and distillability of bipartite Gaussian states, and classi- 
fication of tripartite Gaussian states. We also point out that Gaussian states 
cannot be distilled by Gaussian operations with classical communication. This 
section is ended with a concluding remark. 




( 



states 
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5. 1 General Properties of Quantum Entanglement 

First of all, we introduce the notion of quantum entanglement [191] and briefly 
review its general properties. The notion of quantum entanglement comes from 
the nonlocal properties of a wave function in the Hilbert space composed of 
local Hilbert spaces, Ti = TCa <8> Hb ® • • • ■ A notable example is the wave 
function |^_) = (|0) A |1) B - \ l) A |0) B ) /V2 in the Hilbert space H = Ha^Hb 
with dim?^ = dim7i B = 2. Here, {|0) A ^ , |1) A ( B )} is the orthonormal basis 
of Ha(b)- This wave function cannot be written as a separable form \x) A ® |x) B 
for any local wave functions \x) a anc ^ \x)b- ^ state described by such a wave 
function is called an entangled (pure) state. A statistical mixture of pure 
states is called a mixed state. Whether such a state is entangled or separable 
is defined as follows [192]. 

Definition 1.- A state described by a density operator p (or simply a state p) 
is called separable if it can be written as the convex sum of the tensor products 
of local density operators, 

f. 

P = Y< X iPA®P l B, (272) 
i=i 

where < A, < 1 and J2i=i Aj = 1. Otherwise it is called an entangled state. 

To make the following arguments as plain as possible, we confine ourselves 
to the bipartite case here; we consider only the states on the Hilbert space 
composed of two local Hilbert spaces. 

To distinguish whether a given state is separable or entangled is one of the most 
difficult problems in the entanglement theory and much work has been devoted 
on this subject [193,194,195,196]. The following theorem is fundamental on the 
separability problem [197]. 

Theorem 4-~ Let p be a density operator on the composite Hilbert space 
U = U A ® H B - If p is separable, then p TA > and p Ts > 0. 

Here, p TA is defined as pj£ kl = (vjV k \ p \viVi) = p jKih where \vtVj) = \vi) A ®\vj) B 
denotes an orthonormal basis vector in Ti. with {K)yi( B )} being the orthonor- 
mal basis of Ha(b)- That is, p Tjv is a partial transposition of p on the subsys- 
tem A. p TB is also defined similarly. We say that a state p is PPT (Positive 
Partial Transpose) if p TA > and p Ts > 0. Otherwise it is called NPPT (Non- 
Positive Partial Transpose). Theorem 4 assets that separable states are always 
PPT. It is proven that a PPT state in Ti = Ha ® 7~Lb with dim7i,4 = 2 and 
dimTi,B = 2, 3 is separable [198]. However, there exists a PPT but entangled 
state in higher dimensions [199]. 
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Distillation of quantum entanglement is an operation that extracts a pure max- 
imally entangled state from a several copies of a given state by local quantum 
operations supplemented by classical communication (LOCC). If there exist 
an LOCC operation A LOC c an d n, m e N such that 

Tr[(|^_> <^_|)® m A LOC c(p® n )] < 1 ~e 

for arbitrary e, then the state p is called distillable [200]. Here, p® n is the 
abbreviation of 

p <E> • • • <g> p. 
n 

Because only a maximally entangled pure state provides a reliable task in 
quantum information processing such as quantum teleportation [4] and quan- 
tum cryptography [147], the distillation is of practical significance and the 
distillability is an important characterization of an entangled state. 

All physically admissible operations are allowed for local quantum operations; 
they include local measurements/transformations of the state, adding/removing 
an auxiliary local system (ancilla), etc. Only classical information on the local 
operations can be exchanged through classical channels (Fig. 18). The direct 
transfer of the local states is strictly forbidden. Evidently, entanglement can- 
not be created by LOCC; it is inevitably degraded during the LOCC processes. 
A distillation procedure maximizes the amount of entanglement of a part of 
given states while destroying the rest of them. 




Fig. 18. Procedure of LOCC. 



If p is separable, evidently p is not distillable. However, an entangled state p 
is not always distillable. One of the most useful criteria for distillability is the 
following. 

Theorem 5.- A PPT state is not distillable. 



Ill 



Although it is conjectured that the converse of this theorem is not the case 
in general, the following partial result is known [201,202]. Let p be a den- 
sity operator on the composite Hilbert sp&ceHA <8> 7~Lb with dim Ha = 2 and 
dim7Y^ > 2. Then p is distillable if it is NPPT. As mentioned beforeCPPT 
but entangled states exists, but Theorem 5 asserts that such entangled states 
are still undistillable. Such states that are entangled but undistillable is called 
a bound entangled state [199,203] whereas distillable states are called free en- 
tangled states. It is an open question whether or not NNPT states are always 
distillable (Fig. 19). 



Fig. 19. States on a bipartite Hilbert space. Separable, PPT-BECNPPT-BECand 
FE stand for separable states, PPT bound entangled states, NPPT bound entangled 
states, and free entangled states, respectively. 



There are several distillability criteria other than the PPT criterion [204,205,206,207,208]. 
Among them, the most frequently used is the following reduction criterion 
[207,208]. 

Theorem 6.- If 



then the state p is distillable. 

For example, it can be shown that a phase-damped two-mode squeezed state 
[209] is always distillable by Theorem 6 [210]. We use this reduction crite- 
rion in the proof of the distillability of NPPT bipartite Gaussian states in 
Section 5.2.2. 

5.2 Entanglement Properties of Gaussian States 

Quantum entanglement of the radiation field is a quantum mechanical correla- 
tion between modes of the field. In the following we focus on the fundamental 
properties of entanglement of Gaussian states, i.e., the separability and distil- 
lability [28,211] and review the results obtained so far in depth. Although we 
deal with bipartite Gaussian states in most part of the following arguments, 





(273) 
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we also give a brief overview on the separability of mutipartite Gaussian states 
in Section 5.2.1. 



Let p be a bipartite Gaussian state shard by Alice and Bob and modes 
be in the possession of Alice (Bob). We call the state p the state of x % 
modes (or n^xn^ state) by convention (The total number of modes is n = 
n A + n B ). 

In Section 5.1, we observed that the partial transposition is an important tool 
to characterize the entanglement properties of a given state. So the question is 
how to describe the partial transposition for radiation field systems. In order to 
answer this, we note the fact that the transposition of the density operator p is 
given by p T = p*. Hence, the canonical variable P = —id/dQ changes its sign 
while the canonical variable Q remains unchanged under the transposition. 
As for the covariance, the partial transposition causes the replacement ■jjk — > 
—^jk if one of the two indices j and k refers to the modes undergoing the 
transposition. For a % x % Gaussian state p, the covariance matrix of p TA is 
given by 7 = F7F, where F = F A ® F B with F A = ®^ 1 diag(l, -1). Hence, 
the necessary and suffcient condition for p TA describing a physical state, or 
equivalently, p being PPT is 7 + iJ > by Theorem 4. Here, J a © Jb with 
Ja(b) — ®j=[ B) Ji- This condition is also rewritten as 7 + iJ > 0, where 
J = FJF = {—J a) © Jb- Therefore, we have the following. 

Theorem 7.- A Gaussian state is PPT if and only if its covariance matrix 7 
satisfies 7 + i J > with J = (—J A ) © Jb- 

Note that the displacement in the characteristic function or Wigner function 
can be set to zero by local canonical transformations. This means that the 
displacement is irrelevant to the entanglement properties of the states, so we 
can assume that it is zero without loss of generality. 

First of all, we discuss the separability of a 1 x 1 mode Gaussian state, which 
is a starting point in the following discussion. For a 1 x 1 Gaussian state, 
it is possible to make its covariance matrix to take a simple form by local 
canonical transformations on local canonical variables. Note that the entan- 
glement properties are completely preserved under such local transformations. 
Furthermore, a physical state is always physical under these transformations. 

The covariance matrix of a Gaussian state of 1 x 1 mode is written as 



Here, A, B, and C are 2x2 real matrices, and A = A T > 0, and B = B T > 0. 
From the Williamson's theorem (Theorem 6), there exist symplectic matrices 
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Sa and Sb such that SaASa = diag(n a , n a ) and SbBSb = diag(ri6, where 
n a , rib > 0. By the symplectic matrix © Sb, we have 



(SU © S B h(S A © Sb) 7, = diag(n a , n a , n b , n h ) + 




with C = SaASb. Next, we choose orthogonal matrices Oa,Ob £ 0(2) such 
that .fT = OaCOb is the singular value decomposition of C: K — di&g(k x , k p ) 
with (k x > k p > 0). If Oa(b) is not symplectic, Oa(b) = OA(£)diag(l, — 1) 
turns out to be symplectic. According to the replacement Oa{Ob) — > Oa{Ob), 
we have K — > diag(k x ,±k p ), which is still diagonal. Namely, by choosing 
A ,0 B e Sp(2,R) n 0(2), we have A CO T B = diag(k x ,k p ) with (k x > \k p \). 
Note that A (B)diag(n a (;,), n a ( 6) )05 (B) = diag(n a(6) , n a(6 )). Putting all things 
together, the covariance matrix of the original state is transformed as 



7 - (S' A © S^bO^ © 



(n o ^ 0^ 
n a k p 
k x rit, 

\ k p n b j 



(274) 



by the local symplectic transformation S'a(BS' b with S' A ^ = Oa(b)Sa{b)- The 
matrix in the right-hand side of Eq. (274) is called the standard form of the 
(lxl mode) covariance matrix. From Theorem 1, we have the following. A 
lxl Gaussian state is a physical state if and only if the four parameters in 
its covariance matrix in the standard form satisfies 



d x > 1 



(275) 



and 



d x d p + 1 > n„ + n h + 2k x k 



x rvp. 



(276) 

Here, d x ^ = n a rib — ^j(p)- Furthermore, from Theorem 7 we observe that the 
stats is PPT if and only if 



d x d p + 1 > n n + n h — 2k x k 



(277) 



in addition to Eqs. (275) and (276). Equivalently, the state is NPPT if and 
only if 

d x d v + 1 < n 2 a + n 2 b - 2k x k p (278) 
in addition to Eqs. (275) and (276). 



Since det Sa = det Sb = 1, det A, det B, det C, and det 7 are invariant under 
the transformation [Eq. (274)], and these are given by det A = n 2 al det B = 
det C = k x k p , and det 7 = {n a rib — k 2 )(n a rib — k 2 ). If det A = det B, we call 
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the Gaussian state symmetric. When the state is asymmetric, the fluctuations 
of canonical variables are not balanced between mode A and B as seen from 
the definition of the covariance [Eq. (18)]. For example, if n a > n b , (Q"a) = 
(P|) > (Qb) — {Pb)i or equivalently, the photon number of mode A is larger 
than that of mode B; (a) A ciA) > (ciB a B 



The Wigner correlation matrix also acquires the standard form by local canon- 
ical transformations; 

( N a K x N ^ 
N a K p 
K x N b 



7 



(279) 



K p N b j 



where K p > \K X \ > . A 1 x 1 Gaussian state is a physical state if and only 
if the four parameters in its Wigner correlation matrix in the standard form 
satisfies 

(280) 



D X <1 



and 



Here, D x( , 



D X D P 



1 > A„ 2 



N 2 b 



2K X K P . 



(281) 



x(j>) 



N a Nb — K x ( p )- Furthermore, the stats is NPPT if and only if 



D X D P 



1 < A„ 2 



2K x K p 



in addition to Eqs. (280) and (281). 

Contrary to the covariance matrix, if N a > N b , the photon number of mode 
A is smaller than that of mode B; (a^a^) < la B a B 



5.2.1 Separability 

Firstly, we discuss the separability of Gaussian state of 1 x 1 mode. To be- 
gin with, we note the following fact. As discussed in Section 1.2, a bipartite 
Gaussian state admits the following P representation: 

p = J d 2 ad 2 (3P(a, fi) \a, (3) (a, (3\ . 

If the P functions P{a,j3) are positive, the state is a statistical mixture of 
separable states \a,(3) (a,(3\ = \a) (a\ ® \(3) ((3\ so that the state is separable 
by Definition 1. For a bipartite Gaussian state, the P functions are calculated 

as 
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x exp(zv / 2Ima^ 1 + i\/2Rea£ 2 + iV2Jm/3^ 3 + iV2Re(3£ 4 ) 
1 

x exp 



-^(r-i 4 )£ 



The the P functions P(a, (3) are positive if V > I 4 or 7 > I 4 . This observation 
leads to the following lemma [212]. 

Lemma 1.- Let 7 be a covariance matrix in the standard form [Eq. (274)] for 
a 1 x 1 Gaussian state. If k x k p > 0, then the state is separable. 

Proof. If k x k p > 0, k x > k p > 0. Firstly, let us consider the case k x > 0. We per- 
form two successive local canonical transformations Si = diag( 
with x > and S 2 = diag(y, y -1 , y, y" 1 ) with y > to the canonical variables. 
These symplectic transformations correspond to local squeezing operations 
[see Eq. (21)]. The covariance matrix 7 is changed to 



/ 2 2 
' y z x z n a 



i = S^SrySf S 2 



y 2 k x 



\ 



y 2 x 2 n a y 2 k p 



\ 



y 2 k x y 2 x 2 n b 
y~ 2 k p y~ 2 x 2 n b J 



This matrix is decomposed into the matrix on the Qi,Q 2 plane and that on 
the Pi, P 2 plane. The matrix on the Qi,Q 2 plane is 



(„2 



iq = y 



X Tl a k x 



\ k x X 2 Tli ) 



while the matrix on the Pi, P 2 plane is 



ip = y 



( _ 2 , 

i kp X H/fa 



Because n a ,n b > 0, k x > 0, and k p > 0, we can choose x such that 7q7p = 
7p7q: x = (k x n a + kpUb) 1 ^ / \k p n a + k x n h ) x l^. Since the two commuting matri- 
ces 7q and 7p can be diagonalized simultaneously by a common orthogonal 
matrix, 7' can be diagonalized as 7" = S^i'S T = diag( _) by the 
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orthogonal matrix of the form 



S = 



( 


cos 9 





— sin 9 












cos 9 





— sin# 






sin# 





cos 9 







V 





sin 9 





sin# 


/ 



Here, 

k± = ^y 2 |x 2 n a + x~ 2 n b ± yj (x 2 n a - x~ 2 n b ) 2 + 4A^j 

and 

k'± = -y~ 2 [x~ 2 n a + x 2 n b ± yj {x~ 2 n a - x 2 n b ) 2 + 4^} . 

It is easy to see that SJS T = J, i.e., the orthogonal matrix S is symplectic. 
Since SS2S1 is symplectic, the transformed state is still a physical state so 
that the covariance matrix 7" satisfies 7" + i J > by Theorem 4. This means 
K-k'_ > 1. If we choose y such that k_ = k'_, k + ,k' + > K- = k'_ — 1, i.e., 
7" = S'-f'S 7 ' > I4. From this we have 7' > I4 by noting that S is orthogo- 
nal, and therefore 7' is a covariance matrix for a separable state. Since the 
separable state with the covariance matrix 7' is obtained by local canonical 
transformations from the original state with the covariance matrix 7, the orig- 
inal state is also separable. Secondly, we consider the case k x = 0. In this case, 
k x = k p = and 7 = diag(n a , n a , n b , n b ). By Theorem 4, we have n a ,n b > 1. 
Hence, 7 > I4 and 7 is a covariance matrix for a separable state. □ 

Now let us prove the following Simon' theorem [212]. This result has been also 
obtained by Duan et al. independently [213]. 

Theorem 8.- A Gaussian state of 1 x 1 mode is separable if and only if it is 
PPT. 

Proof. Since the separable states are always PPT by Theorem 1, it suffices to 
prove that the PPT condition implies the separability. Firstly, let us assume 
that k x k p < in the covariance matrix of 1 x 1 Gaussian state p written in the 
standard form [Eq. (274)]. If p is PPT, the partially transposed state p TA is 
a physical state; p TA > 0. The covariance matrix of p TA is given by Eq. (274) 
with k p —>■ —k p , so that p TA is separable by Lemma 1. Therefore, the original 
state p is also separable. Secondly, we consider the case k x k p > 0. The state 
is separable by Lemma 1 and Eq. (277) is always satisfied due to Eq. (276). 
Therefore, we conclude that the PPT condition implies the separability. □ 

For general bipartite Gaussian states, we have the following necessary and 
sufficient condition for separability [214,215]. 
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Theorem 9.- A Gaussian state with covariance matrix 7 is separable if and 
only if there exist covariance matrices ^a and 7^ such that 



7 > 1a © 7b- 



^282) 



Proof. Suppose a bipartite Gaussian state p is separable: p = J2k ^kp\ 
The covariance of p is calculated as 



Pb- 



lap 



a/3 



2 Ajtm^m^ - 2m a m /3 , 

k 



(283) 



where 1a(b) ls ^ e covariance matrix of Pa(b) and m, 



Tr (pi? Q ) = E fc A fc Tr (p A © p^i? a 
Afcm^ . Here we define a matrix A = 7 — J2k^k (ia^Ib)- By noting 
J2k Afc = 1 and using Eq. (283), it is easy to see that £ T A£ = J2k 1 ^k^i(sk — 
Sl f > for every vector £ £ R 2/ , where Sfc = E^&m*. That is, the ma- 
trix A is positive (semi-)definite. Hence, we have 7 > 7a © 7b by choosing 
1a(b) = Sfc Afe7^(m- Conversely, let us suppose that 7 > 7a ©7s- That is, 7 is 
written as 7 = 7^ © 7b + -P with P > 0. Let cr(d) be a density operator with 
the covariance matrix 7^ © 7^ and the displacement d: 



a(d) oc J d 2n £exp 



7B ) J( + i(Jd) T t 



Note that o~(d) is separable. It is easy to observe 



d da(d) exp 



-d T P~ l d 



oc / d 2n £exp 



4 



M-0- 



W(-0 oc p. 



That is, p is a statistical mixture of separable density operators a(d) with 



positive weight exp 



-d^P^d 



. Namely, p is separable by Definition 1. □ 



Now let us define a minimal PPT state as follows [214]. If 7 + iJ > and 
7 + zJ > 0, 7 is called a PPT covariance matrix. Furthermore, the PPT 
covariance matrix 7 is called minimal if 7 = 7' for any PPT covariance matrix 
7' such that 7 > 7'. A Gaussian state with minimal PPT covariance matrix 
is called a minimal PPT state. Under this definition, we have the following 
[214]. 

Lemma 2.- A PPT covariance matrix 7 is minimal if and only if 

supp(7 + U) n supp(7 + iJ) = 0. (284) 



Here, suppM = {<3>|M$ ^ 0} denotes the support of M. 

Proof of Lemma 2. Let us suppose that the PPT covariance 7 is minimal. If 
Eq. (284) is violated, then there exists a vector £ e C 2 ^ such that tf(y+i J)£ > 



118 



0, i.e., 7 + i J > = eA for some e > 0. We also have 7 + i J > eA. Now let 
7' = 7 — eA. Since 7' + i J > and 7' + z J > 0, 7' is a PPT covariance matrix. 
However, it is not minimal because 7 > 7' and 7 ^ 7'. This contradicts our 
assumption that the PPT covariance matrix 7 is minimal. Therefore, Eq. (284) 
must be satisfied. Conversely, let us suppose that Eq. (284) holds. If the PPT 
covariance matrix 7 is not minimal, there exists a PPT covariance matrix 7' 
such that 7 > 7' and 7 7^ 7'. It is always possible that A = 7 — 7' be a matrix 
of rank one: A = £ft. Since i + iJ > 0, we have ^(7 + iJ)£ > £ f A£ > 0. We 
also have ^(7 + iJ)£ > 0. This means that £ G supp(7 + iJ) fl supp(7 + iJ), 
which contradicts Eq. (284). Therefore, 7 must be a minimal PPT covariance 
matrix. □ 

Note Hiat Eq. (284) is equivalent to ReMu ReAT = X. Here M = Ker(7 + iJ) 
and A/" = Ker(7 + iJ) and ReV^ denotes the real restriction of the complex 
vector space V; it consists of all real parts of vectors in V. This is a subspace 
of the phase space X. We have dimReA/" < 2/ since dim Re V = 2dimV A by 
definition of the real restriction. 

Now, let us prove the following theorem [214] that is the extended version of 
Theorem 8. 

Theorem 10.- A Gaussian state of 1 xiig modes is separable if and only if it 
is PPT. 

Proof. Since the separable states are always PPT by Theorem 1, it suffices 
to prove that the PPT condition implies the separability. In the following, we 
confine ourselves to the separability of minimal PPT states. If every minimal 
PPT state is shown to be separable, every PPT state is also separable by 
Theorem 9. Firstly, let us suppose that MdM ^ {0}. Then, there exists a 
vector $ such that^ e A/YW^ 7^ 0). Since $ satisfies (7+zJ)$ = (7+zJ)$ = 
0, we have (J — J)$ = 0. If we write the vector $ as $ = (x±, X2, ■ ■ ■ , ^2/) T 5 
(J — J)$ = (22, —Xi, ■ ■ ■ ) T = 0. This means that the first two component 
(Alice's part) of $ are zero; $ = (0,0) T © $ B ($ B 0). Here let X B denote 
Bob's phase space (dimX^ = 2/b) and Xq be a real restriction of Mb = 
Ker(7# + iJb)' Xq = KbMb- This is a subspace of the phase space Xb and is 
defined as the phase space of the subsystem C (dimX c = 2/c). For a vector 
$b G Mb, we write its restriction on the subsystem C as $c- Then, $ c satisfies 
(lc + iJc)^c — 0. Hence, dimA/e < dimAc- Here, Mc = Ker(7 C + iJc)- 
Therefore, dimXc = dimReA/^ = 2d\mMs < 2 dimAc < dimXc, i.e., 
dimXc = 2 dimA/'c = dimReA/c so that the state on the subsystem C is pure 
(see the comment below Theorem 5). This means that the state on the total 
system is written as Pa,b\c,c — Pa,b\c®Pc- So we can focus on the separability 
problem of the states pa,b\c of the smaller system and assume M H M = {0} 
in the following. Let us suppose that $(7^ 0) G M and $(7^ 0) G M. Note that 
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$ ^ A/". Since 7 is Hermitian, ^$,7$^ = ^7$,$^. By noting 7$ = -zJ$, 

7$ = -zJ$, and (iJy = iJ, we have —iJ&) = (—iJ$, = (<l, -zJ$^>. 

Namely, $ is orthogonal to (J — J)$: (J — = 0. Here, the vector 

(J— J)$ must be non-zero. Otherwise we would have (7 + 2,/)$ = (7 + iJ)$ = 
0, contradicting our assumption $ ^ TV". Since J — J = (2Ja)©0, (J— J)$ ^ 
means that Alice's part of $ is non-zero. Alice's part of $ is also shown to be 
non-zero. If dim A/" > 2, dim Ma > dim M > 2 so that there exist two mutually 
orthogonal vectors $1 = $^ © (0, • • • , 0) 6 M and <3> 2 = $a © (0, • • • , 0) G A" 
with ^ $^ 2) . Now, for a vector $ = $ A ffi(*,-- - ,*), both (J-J)$; = $^ 
and (J — J)$' 2 = $^ must be orthogonal to $. This means that three two- 
dimensional vectors, $^ , $^ , and $^ must be orthogonal to each other. 
This is impossible and we must conclude dim M = 1. It is also shown that 
dim M = 1 in a similar manner. So we have dimReA/" = dimReA/" = 2. 
Since 7 is a minimal PPT covariance matrix, ReA/" U ReA/" is identical to the 
phase space A (see the comment below Proof of Lemma 2). Hence, dim AT < 
dimReA/"© dimReA/" = 4. This means that dim A = 4 because dim A > 4. 
That is, A is a phase space of the lxl mode system. Therefore, the state is 
separable by Theorem 8 because it is PPT. □ 

Can we remove the restriction on the mode in the above theorem? Unfor- 
tunately and expectedly, we cannot do so. There exists an entangled PPT 
Gaussian states, i.e., a bound entangled bipartite Gaussian state. Such exam- 
ples (2 x 2) are shown explicitly by Werner and Wolf [214]. 

Theorem 9 gives a necessary and sufficient condition for the separability of 
all bipartite Gaussian states. However, it is a difficult task to check whether 
Eq. (282) holds or not for a covariance matrix of a given state. The following 
operational criterion devised by Giedke et al. make it possible to determine 
whether a given state is separable or not by a series of simple computations. 

We write a covariance matrix of a bipartite Gaussian state as 



To 



A Co 



Starting from this, we construct a sequence of matrices {■Jn}n=o according to 
the following nonlinear map: If 7^ — i J > 0, An+i = Bn+i = An — Re(Ajy) 
and Cn+i = — Im(Ajv)- Otherwise, 77V+1 = 0. Here, Xn = Cn(Bn — iJ^C^ 1 
and 

/ 



In 

Now, we have the following theorem. 



An Cn 
yC N Bn 
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Theorem 11.- 



(1) If for some N G N, we have — iJ \ ^ 0, then p is not separable. 

(2) If for some N G N, we have A N — | |Cjv| | op I — « > 0, then the state p is 
separable. Here, || • || op denotes the operator norm. 

In order to check the separability of a Gaussian state, we just apply the non- 
linear map 7 at — > 7at+i starting from 7 until (1) or (2) in Theorem 11 is 
met. 

The separability problem of bipartite Gaussian states has been thus completely 
solved. 

For mutipartite Gaussian states [216,217,218], the problem is not simple; there 
are many different ways in which each subsystem is entangled/disentangled to 
other subsystems. At present the classification problem of multipartite Gaus- 
sian states is solved only for the simplest system, a 1 x 1 x 1 tripartite Gaussian 
state [218]. 

Let us consider a Gaussian state composed of three subsystems A, B, and C, 
each of which holds only one mode. This tripartite state is also considered 
as a bipartite state if two subsystems A and B are grouped together for in- 
stance. We write such a bipartite state AB-C and say that the total system 
is divided into two subsystems AB and C by a bipartite cut between AB and 
C. Since a bipartite state AB-C is a 2 x 1 mode state, Theorem 10 can be 
applied. According to the number of bipartite states with different bipartite 
cuts exhibiting NPPT/PPT, we have the four different classes. 

Class 1: Fully inseparable states that is NPPT under all three bipartite cuts. 
Class 2: Partially inseparable states that is NPPT under two bipartite cuts 

but is PPT under the remaining one. 
Class 3: Partially inseparable states that is NPPT under one bipartite cut 

but is PPT under the remaining two. 
Class 4: States that is PPT under all three bipartite cuts. 

Continuous-variable analogues to Greenberger-Horne-Zeilinger states consid- 
ered in [217] belong to Class 1. Note that PPT under all bipartite cuts does not 
imply the separability. The last Class 4 is further divided into two subclasses. 

Class 4a: Entangled states pabc that cannot be written as the statistical 
mixture of product states as 

Pabc = E Va ® Pb ® Pc- (285) 

i 

Class 4b: Fully separable states that can be written as Eq. (285). 
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NPPT 




NPPT NPPT 
(a) Class 1 



PPT 





PPT 



NPPT NPPT 
(b) Class 2 




PPT 



PPT NPPT PPT PPT 

(c) Class 3 (d) Class 4a and 4b 



Fig. 20. Classification of 1 x 1 x 1 Gaussian states. 

Namely, we have five different entanglement classes for tripartite lxlxl 
mode Gaussian states in total (Fig. 20). States of Class 4a are tripartite bound 
entangled states. The complete criterion to distinguish between Class 4a and 
4b has been also obtained by Giedke et al. [218]. 



5.2.2 Distillability 



The classification of bipartite Gaussian states by distillability is completely 
solved and it is established that the NPPT condition is the necessary and 
sufficient condition for the distillability by Giedke et al. [219] 

Theorem 12.- A bipartite Gaussian state is distillable if and only if it is NPPT. 

Although, we cannot rule out the possibility of existence of undistillable (bi- 
partite) NPPT states in the general setting, the family of Gaussian states does 
not harbor such peculiar states. 

To prove this, we need three lemmas. 

Lemma 3.- An NPPT lxl symmetric Gaussian state is distillable. 

Proof. According to the reduction criterion (Theorem 3), if there exists a state 
vector \ip) such that 

(iP\Tr B p®I B - p\iP) < 0, (286) 



122 



then the state p is distillable. The covariance matrix of p is written in the 
standard form (274) without loss of generality: 



7 




Here, 7a = 7b = diag(n,n) and C = dia.g(k x ,k p ). By noting Ttb>V(— £b) 
2tiS^(^b), we can take the partial trace of p; 



= i / d ^ Aexp {-\^Ja1aJaU) w(-a). 



(287) 



Now, let us take a two- mode squeezed state as the state vector = 
(coshr) -1 J2™=o tanh™ r \n) A ® \n) B . The covariance matrix of the pure state 



takes the form 



5 



D T S f 



>B 

Here, 5a = $b = diag(cosh2r, cosh2r) and D = diag(sinh2r, — sinh2r). 

Ttb takes the form of the right-hand side of Eq. (287) with the replace- 

ment 7^ — > Sa- Now, we have 



M TtbP ® Ib |^> = Tr A (Tr B pTr B (^1) 
= (27rP / d ^ A I rf ^ exp ("^Mta-Za^i - -£a Ja$aJa£'a^ 
xTr A \W(-U)W(-&]. 

After integration, the result is \ Tr B p® Is IV') — 2[det(7A + <5A)] _1//2 - Similar 
calculations yield (V>| p |^) = Tr(p \<ip) (V>|) = 4[det(7+<5)]" 1 / 2 . Hence, Eq. (286) 
is written as [det(7A + Sa)]^ 1 ^ 2 < 2[det(7 + <5)] -1 / 2 , which turns out to be 
(n — k x )(n + k p ) < 1 for r — > oo. Here, we observe that the NPPT condition 
[Eq. (278)] yields (n — k x )(n+k p ) < 1 by noting k x k p < for inseparable states 
(Lemma 1). Therefore, Eq. (286) holds for the two- mode (infinitely) squeezed 
state |^) so that p is distillable. □ 

Lemma 4-~ An NPPT lxl Gaussian state can be transformed by LOCC into 
a symmetric NPPT lxl state. 

Proof. If the state is not symmetric, the photon number of one mode is larger 
than that of the other mode. So it is expected that the symmetrization can 
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be achieved by equalizing the photon number by mixing the mode of larger 
photon numbers with a vacuum mode of physically minimal photon numbers. 
In the following, we show that this local operation can be done successfully 
under the NPPT condition. We write the Wigner correlation matrix 7^ of the 
state in the standard form [Eq. (279)] with N a > N b . The Wigner correlation 
matrix of the vacuum mode used as an ancilla is given by 7^, = diag(l, 1). 
The displacement of the vacuum mode is always zero. Now, let us make a local 
compound system B+ancilla to pass through a beam splitter. In the language 
of phase space, we apply a symplectic transformation S = 1 A © S bs on the 

Here, 



la 



Wigner correlation matrix of the total system, 7^ +an , 
the symplectic matrix S bs is given by Eq. (20). The Wigner correlation matrix 
lAB+anc is changed to 



1ab+ anc 



S T 1 AB+ancS 



M AB C 
C T M nn 



(288) 



where, 



M AB 



C 



N a 



N n 



cK x 




cK x c 2 N b + s 2 



cK p 




cK p 

1 sK x 



sc{N b - 
1 



c 2 N b + s 2 

\ 

sK p 
1) 

sc(N b -I)) 



and 



diag(c 2 + s 2 N b , c 2 + s 2 N b ) 



(289) 



(290) 



with c = cos 8 and s = sin 9. The Wigner function for the state of 
system is given by 



(291) 
the total 



WAB+anc{XA j PA 1 ^BiVBi ^anci Vane ) 
1 



7r 3 Jdet i Am 



exp 



( X A, ■ • • , Panc)l AB+anc{ X ' " * ,Panc) J 



(292) 



If we measured the P-quadrature of the ancilla with the measured result po, 
the Q-quadrature of the ancilla would be completely uncertain and the Wigner 
function would take the form 

W A b{xA,PA,Xb,Pb) = / dx anc W AB+ anc{xA,--- 
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Substituting Eq. (292) with Eqs. (288), (289), (290), (291) into the above 
equation and performing Gaussian integration, we obtain 



W AB (x A , ■■■ ,Pb) oc exp \ -(x A , ■ ■ ■ ,p B )M AB (x A , ■ ■ ■ ,p B f 

where, 

( M A C 



M AB 
with 



{C 1 M B 



(293) 



and 



M B = diag(c 2 iV fe + S 2 - s2c2(iV6 




s 2 N b + c 2 

In order to put the state with the Wigner correlation matrix Eq. (293) sym- 
metric, det M A = det M B must hold. This yields 

N 2 - N 2 

This equation has a real solution for 6 only when N b —D x N a > since N a > N b . 
Here, we note that N b -D x N a > is equivalent to (N b — D x N a ) (N a — D p N b ) > 
0, which turns out to be (N b - D x N a )(N a - D p N b ) = (N a K x + N b K p ) 2 > by 
Eq. (281). Therefore, there always exists a 9 satisfying Eq. (294). The proof 
is thus completed. □ 

Lemma 5.- An NPPT n A x n B Gaussian state can be transformed by LOCC 
into a 1 x 1 NPPT state. 

Proof. Let 7 denote the covariance matrix for an NPPT Gaussian state of 
n A x n B modes. Since the state is NPPT, there exists a vector £ G C 2< - nA+ns - ) 
such that 

^(j + iJ)^ < -e < (295) 
for some e > by Theorem 7. J is again given by J = {—J a) ® Jb- Here, 
we write £ = f W © ^ and = & A ' B ^ + i^ A ' B) (£f G M 2n ^ and 

£^ G IR 2ns ). It can be assumed that two vectors <^ A ' B ' ) and ^ A ' B ^ satisfy 
d AB)T J^' B) + 0. If ^ A ' B)T J^' B) = 0, we can replace by = 

£(A,B) + 6{A ,B)j^A,B) with 5 (A,B) ^ Q> go th&t ^,B)T^(A,B)/ ^ g and £ t ( 7 + 

-» ^(7 + *J)€ + 0(5 {A ^). Therefore, Eq. (295) still holds if \5^ A ^\ 
is sufficiently small. Now we construct local canonical transformations S A as 
follows. We choose fj A ^ (j = 1,2, ••• , 2n A ) such that JaI^-i = $jki 
/ifl-W^ = ti? T JAf { 2 t ] = (j,k = 1,2,..- ,n A ) with f[ A) = ^ and 
f% = — (£i^ T ^£i j -1 ^} ■ This is always possible and {fj A ^}^=i constitutes 
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a basis of the local phase space Xa [31]. Here, we define S^e^ = /j (j 



1,2,--- ,2n A ) for e! A) = (1, 0, 0, • • ■ , Of, e^ J = (0, 1, 0, • • ■ , Of , • ■ ■ e 



The matrix 5a (and 5j) thus defined is shown to be symplectic. The matrix 
Sb is also defined in a similar manner. A vector defined as t\a = (S'J)~ 1 ^ < - A ' ) 
takes the form aA&i^ + &aC2 by definition of 5a, where oa, &a G C. In a sim- 
ilar manner, a vector 775 = (5#f is written in the form clb^i + i>B&^\ 
where as, &b G C. Now, we apply the local symplectic transformation 5a ©5# 
on 7; 

Y = (5 A © 5 b ) 7 (5a © 5 s f . (296) 
By noting (S A © S B )J(S A © 5 B f = J, Eq. (295) is rewritten as 

+ iJ)rj < 0, (297) 



where = t}a@t}b- Since all components of vectors t]a and 7/b other than their 
first two are zero, Eq. (297) is further rewritten as 



V'Klred + iJredW < 0, 



(298) 



where 77' = (a a, &a) t © (as, 6b) 



7red 



'1,1 



7 2 ,i 



7i,2 
7 2 ,2 



7l,n A +l 



7l,n 4 +2 



72,n A +l 72,n. 4 +2 



7n.4+l,l 7n J 4+l,2 7nA+l,n.4+l 7n J 4+l,riA+2 
V7n A +2,l 7n A +2,2 7n A +2,nA+l 7n A +2,nA+2 / 



and J re rf = (— Ji) © Ji. 7 rec j is the covariance matrix of a 1 x 1 state that is 
obtained by local canonical transformations [Eq. (296)] followed by tracing out 
the local modes other than the first one at each local side. Since the sequence 
of these operations is LOCC, it partially destroys the entanglement of the 
state. However, the resulting state is still NPPT owing to Eq. (298). □ 

Proof of Theorem 12. Since distillable states are always NPPT by Theorem 
2, it suffices to show that the NPPT condition implies the distillability. If a 
tia x fis Gaussian state is NPPT, it can be transformed into a NPPT lxl 
Gaussian state by LOCC (Lemma 5). This state can be further transformed 
into a symmetric lxl Gaussian state by LOCC (Lemma 4). The resulting 
state is distillable by Lemma 3. □ 



Several distillation protocols for Gaussian states have been proposed so far 
[103,220,221,222]. For example, the protocol of Duan et al. utilizes the local 
quantum nondemolition measurement and distills Gaussian states to finite- 
dimensional maximally entangled pure states [220,221]. This scheme is physi- 
cally feasible but the experimental realization may be a long way off. So the 
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natural question is: Can we make a distillation protocol with local quantum 
operations that are much more tractable experimentally? One such a candi- 
date for local quantum operations is a Gaussian operation or Gaussian channel 
that maps every Gaussian state into a Gaussian state. The Gaussian opera- 
tion is shown to be implementable by linear optics with homodyne detection 
[223,224,225] that are experimentally accessible with current technology. The 
recent research work, however, have dashed this hope. It has revealed the fol- 
lowing discouraging fact: Gaussian states cannot be distilled by local Gaussian 
operations and classical communication [223,224,225]. This means that a dis- 
tillation protocol for Gaussian states must involve non-Gaussian operations at 
some stage. In the protocol proposed by Eisert et al. [103], a non-Gaussian op- 
eration is required only in the initial step and a series of Gaussian operations 
of [226] is applied in the subsequent steps. The non-Gaussian operation does 
not require too much; it consists of a single measurement that distinguishes 
between vacuum states and non-vacuum ones. 



5.3 Conclusions 



In this section, we have reviewed the entanglement properties of Gaussian 
states starting from the fundamental level. We have focused on the quali- 
tative characterization of Gaussian state entanglement, i.e., the separability 
and distillability and have given the complete proofs on several results. The 
important point is that the complete characterization by separability and dis- 
tillability has been established for bipartite Gaussian states. 

For the quantitative description of entanglement, some entanglement measures 
[227] are required. Among them, the logarithmic negativity (or negativity) 
is computable and is widely used in the theory of Gaussian state entanglement, 
although it is not a true entanglement measure in a rigorous sense [228] . The 
explicit formula of for a 1 x 1 Gaussian state can be written in terms of 
parameters of the covariance matrix in the standard form. General formula of 
other entanglement measures such as entanglement of formation (Ep), relative 
entropy of entanglement, and the distillable entanglement for general Gaussian 
states are not known yet. However, Giedke et al. give a closed formula for Ep 
of a 1 x 1 symmetric Gaussian state [229] . One of the biggest problem related 
to the entanglement measures is the additivity question of Ep, i.e., whether 
or not Ep(pi <S> P2) = E F (pi) + Ep(p 2 ). Is this additivity holds for Gaussian 
states? The answer is not known yet. 

We do not intend that this section is a comprehensive guide to literatures. 
So, many important literatures have been omitted in the references. Some of 
them are, however, found in the excellent review articles [230,50]. 
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6 Classical capacities of Gaussian channels 

In this section, we review the classical capacities of Gaussian channels and 
their properties. Firstly, we introduce basic ideas of classical information trans- 
mission via a quantum channel in Section 6.1, which includes the concept 
of mutual information, Shannon capacity, Holevo- Schumacher- Westmoreland 
capacity, and Holevo capacity. The dense coding scheme is also introduced. 
Secondly, we define the Gaussian channels and show the additivity property 
of a special case of Gaussian channel - a lossy or attenuation channel in Sec- 
tion 6.2. The explicit formula of the von Neumann entropy for Gaussian states 
is given and its properties are discussed. Thirdly, we discuss the properties of 
Gaussian channels with Gaussian inputs in Section 6.3, where we note that 
the Gaussian Holveo capacity is greatly simplified due to the special proper- 
ties of von Neumann entropy of Gaussian states discussed in Section 6.2. We 
mention the additivity properties of some Gaussian channels with Gaussian 
inputs. Finally, in Section 6.4, we review the dense coding with Gaussian state 
entanglement. 

6. 1 Classical Capacities of Quantum Channels 

In this section, we introduce basic ideas of classical information transmission 
via a quantum channel [1,231]. Suppose that the sender (Alice) has some mes- 
sages X = {xi,X2, ■ ■ ■ ,x n } that she wants to send to the receiver (Bob) by 
using a noisy quantum channel $. To this end, Alice encodes her message 
using a quantum state p x (x G X) with a priori probability p x . The input 
state p x is changed to &(p x ) at the output of the channel, where Bob de- 
code the message by measuring the received state $(p x ) by a suitable positive 
operator-valued measures (POVM) {E y } = {E\, E2, • • ■ , E m } with the proba- 
bility Tr(E y <&(p x )). The channel is completely characterized by the conditional 
probability p y \ x for the probability of obtaining y G Y given that Alice sent 
a message x G X if the channel is memoryless and the signal states p x and 
the POVM {E y } are fixed. In the memoryless channel, the signal states p x 
are independent of earlier or later usage of the channel. The probability of 
obtaining y G Y is given by p y = J2xPy\xPx and the joint probability of x G X 
and y G Y is computed as p x>y = p y \ x p x . The amount of information gained 
by Bob is given by the following mutual information, 

H(X : Y) = H(X) + H{Y) - H(X, Y) = H(Y) - H(Y\X), (299) 

where H{X) = — J2xPx^Px and H(X,Y) = —J2xPx,y^Px, y are Shannon 
entropies and 

H{Y\X) = Y,PxHiY\X = x) 

x 
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denotes the conditional entropy with H(Y\X = x) = — hip,^. Note 

that the mutual information [Eq. (299)] is written as 

H(X : Y) = Y,Px,y = Py\xPx^ Pj ^. (300) 

x,y Py 



One of the most important bounds on the mutual information is the following 
Holevo bound. 

H(X :Y)<S(p)-J2PxS(Px), 

X 

where p = J2 x PxPx- 

When the set of signal states {p x } and the POVM {E y } are given, the achiev- 
able classical capacity of a quantum channel is calculated as the supremum of 
the mutual information over all probability distributions of input signal states; 

C s ($) = supH(X : Y). (301) 

Px 

This is the quantum version of Shannon's noisy channel coding theorem and 
we call the capacity given by Eq. (301) the Shannon capacity. 

Yet, a further optimization over the quantum states to be sent and the POVM 
yields the ultimate information transmission rate. This defines the usual clas- 
sical capacity of a quantum channel. By noting entangled signal states are 
allowed for n invocations of the channel, the classical capacity of the quantum 
channel $ is calculated as 

C HSW m = lim -X(^ n ) (302) 

n— >oo 72, 



with 



(303) 



X($) = sup 

{Px,Px} 

where p = J2xPxPx and the supremum is taken over all probability distribu- 
tions and sets of states. This result is the content of the cerebrated Holveo- 
Schmacher- Westmoreland (HSW) theorem [232,233]. Hereafter we call the ca- 
pacity given by Eq. (302) the HSW capacity. The quantity defined by Eq. (303) 
is called the Holevo capacity. 

If the input is a product states p^ = p x> i ® p x> 2 ® • • • <8> p x ,n for n invoca- 
tions of channel <3>, then x($ m ) = so that C HSW (&) = x(®)- That is, 
the Holevo capacity x(^) gives the sing le-shot HSW capacity Cg^($). By 
definition, C^ sw (^) < Chsw(&)- However, it is conjectured that 



£*(*i) (304) 
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holds. This is called the additivity conjecture of the Holevo capacity [234]. If 
$j in Eq. (304) are identical for all i, we have Cjj SW ($) = Chsw{&)- Even this 
weak form of additivity question is still open for general quantum channels. 

The classical capacity can be increased if there is an additional resource in the 
form of an entangled state shared between Alice and Bob. Such an augmented 
capacity is called the entanglement-assisted classical capacity [235] . The dense 
coding [49] is the fundamental scheme of entanglement-assisted quantum com- 
munication. The transmission of classical information via a quantum channel 
in the dense coding scheme goes as follows. Initially, Alice and Bob share 
an entangled state pab- Alice performs a unitary transformation U m [or gen- 
erally a completely positive trace preserving (CPTP) map] on her state to 
encode the message and send the transformed state to Bob via the quan- 
tum channel. Upon receiving this transformed state, Bob combines it with 
his initially shared state and retrieve the message by POVM on the state 
{U m <S> lB)pAB{U m <S> 1b)- If the quantum channel is noiseless and the initially 
shared state pab is on the Hilbert space 'Ha®'Hb with dimli,A = dim7is = d, 
the optimal capacity of the dense coding is given by [236] 

C d = \nd+S(p B )-S(p AB ), (305) 

where ps = T^aPab and we have assumed the unitary coding. If pab is the 
maximally entangled state, pab = |^+) ("0+1 with = rf _1 ^ 2 Z)iLi K)^®^)^, 
then S{ps) — S(pab) = lnrf so that = 2 hid For d = 2, 2 bits of classical 
information can be transmitted by sending a single qubit. The capacity of 
Eq. (305) is based on the HSW theorem. If the signal states and the decoding 
scheme are given, the dense coding capacity is computed via the Shannon 
capacity [Eq. (301)]. 



6.2 Gaussian Channels 

A Gaussian channel $ is a CPTP map that transforms the Weyl operator 
= exp(i£ T JRy as follows. = exp{t£ T JR) as follows. 

W(O^W(XO exp (-^ T n), 

where X and Y are In x 2n real matrices Y is positive and symmetric {Y = 
Y T > 0). Here, we have assumed that both the input and output Gaussian 
are n mode state. The complete positivity of the channel is expressed in terms 
of these matrices as [237] 

Y + U n - iX T J n X > 0. 
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Among quantum channels for continuous variable systems, a Gaussian channel 
has its own significance. Namely, it corresponds to the so-called Gaussian 
operations that can be implemented by current experimental techniques such 
as beam splitters, phase shifters, squeezers, and homodyne measurements. 
Optical fibers in optical systems are well modeled by Gaussian channels. The 
covariance matrix is transformed according to 

7 0( 7 ) = X T 1 X + Y 7 (306) 

Hereafter, we write a Gaussian channel by a capital Greek letter and the 
corresponding transformation on the covariance matrix by the corresponding 
lower case Greek letter. 



The von Neumann entropy plays a fundamental role in the analysis of various 
capacities of quantum channels. The von Neumann entropy of a Gaussian state 
is given in terms of the symplectic eigenvalues of the state. Here, we derive the 
formula for the von Neumann entropy of a Gaussian state following [238,239]. 
We note that the von Neumann entropy can be computed as 

S(p)=-Vm±\\p\\ pt (307) 

where ||p|| = (Tr \p\ p ) l ^ p is the Schatten p-norm (p > 1) and |A| = V A^A. 
Without loss of generality, we can assume that the displacement of the Gaus- 
sian state is zero because of the unitary invariance of the von Neumann en- 
tropy, by noting that the the displacement of the Gaussian state can be always 
set to be zero by a unitary transformation. By virtue of Williamson theorem, 
the covariance matrix is written as 

n 

7 i > S-fS T = Vjl 2 (308) 

3=1 

with Vj G [l,oo) and S G Sp(2n, R). This symplectic transformation corre- 
sponds to a unitary transformation in the underlying Hilbert space. Therefore, 
a Gaussian state is unitarily equivalent to the state with covariance matrix 
given by the right-hand side of Eq. (308) and vanishing displacement, which 
is written as 

n 9 00 ( v - 1 \ k 

p = ®—i^ l^+T !*>«<*! (309) 

j=i u i ^ i k=Q VjTiy 
in the Fock space representation, where 

|A) =-L(a})*|0), fc = 0,l,-.. 



denotes the number state of the jth mode. Equation. (309) describes the state 
in a thermal equilibrium (the thermal state) with the average photon number 
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of the jth mode being [n)- = [yj — l)/2. From Eq. (309), we have 

n np 

Tr/=n 



,-=i Ui v i) 

with f p (x) = (x + l) p — (x — l) p . Therefore, form Eq. (307) 



s( P ) = ±g(^j 1 ) (3io) 



i=i 
with 



g(x) = (x + 1) ln(x + 1) — xlnx. (311) 
Equation (310) with Eq. (311) gives the von Neumann entropy of a Gaussian 
state p. 



Since 



1\ (X • Gin / 
\ J , . , I fn — 1 



\ Z/j + 1 J \ Vj + 1 

the state [Eq. (309)] is also written as 



A 2 /zA-lV^ 



It is evident from this equation that lnp depends linearly on rij = ajaj. This 
observation leads to the following important theorem [240]. 

Theorem 1. - Among all states with fixed covariance matrix, the Gaussian 
state is one which maximizes the von Neumann entropy. 

Proof. Let p be a Gaussian state with fixed covariance matrix. There exists a 
state p with the same covariance matrix. Without loss of generality, we assume 
that the displacements of p and p are zero. We thus have 

S(p) — S(p) = Trp(ln p — In p) + Tr(p — p) In p. 

The first term on the right-hand side is the nonnegative relative entropy and 
the second term vanishes since Tr (pa^a-^j = Tr {jja^a^ and lnp is a linear 

function of rij = OjCij. Therefore, we have S(p) > S(p). This completes the 
proof. □ 



Important examples of Gaussian channels are classical channels and thermal 
noise channels including lossy or attenuation channels. 

In the classical noise channel, a classical Gaussian noise is added to the input 
states. Since W(£)-RjWt(£) = Rj the classical noise channel is described 
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by 



(312) 

with Y > 0. In Eq. (312), P( 7/m ) stands for a Gaussian state with covariance 
matrix 7 and displacement m. Namely, the transformations of covariance ma- 
trix is given by 

d ( 7 )= 7 + F. 

In the thermal noise channel, the signal Gaussian states interact with an en- 
vironment that is in thermal equilibrium. This channel is modeled by beam 
splitters that couple the input Gaussian state and the thermal reservoir. Let 
cij and bj be annihilation operators of the jth mode of the singnal state p 
and the thermal state p t h that acts as a thermal reservoir. The action of the 
beam splitter is described by the transformations, aj t— > cos8jCij + sin6jbj and 
bj 1 — > — sin 9 jdj + cos 8 jbj. Accordingly, the corresponding symplectic trans- 
formation Sj takes the form of Eq.(20) with 9 = 6j, Therefore, the output 
Gaussian state has the covariance matrix, 

^( 7 ) = Tr t ,[^ 1 ( 7 © 7t / l )(^ 1 ) T ], (313) 

where 5* = 0" =1 Sj, 7^ = 0™ = i (2 (n) ■ + l) I 2 denotes the covariance matrix 
of the thermal state p t h with (n) • being the average photon number of the 
jth mode, and Tr t h describes the trace over the thermal state. The right-hand 
side of Eq. (313) is calculated as 

th ( 7 ) = X T 1 X + Y, (314) 

where 

^ = 0^2 (315) 
i=i 

and 

n 

Y = ® (2 {n)j + l) (1 - Vj )h (316) 

i=i 

with r/j = cos 2 9j being the transmittivity of the beam splitter. At zero tem- 
perature ((n)j = 0), the thermal noise channel is reduced to the lossy or 
attenuation channel [241,242]. 

At present, the additivity of Holevo capacity is proven and the HSW capacity 
is computed exactly only for the lossy channel among Gaussian channels[243], 
which is shown in the following. In the following discussion, we need the fol- 
lowing theorem [244]. 

Theorem 2. - Among all single mode states (that are not necessarily Gaussian) 
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with fixed average photon number, the thermal state is the one that maximizes 
the von Neumann entropy. 



Proof. The average photon number of the mode of frequency ui and therefore 
the energy E = Ti(pH) of the mode is fixed with H = u(a J< a + 1/2). The prob- 
lem is to find the state maximizing the von Neumann entropy S = — Tr(plnp) 
under the normalization condition Trp = 1. This is given by the solution of 
the variational problem 

5 [— Tr(plnp) — pTi(pH) — vTip] = 0, 

where /i and v are Lagrange multipliers. Direct computations yield 

with Z(j3) = Tr exp(— (3H) and j3 = (S/E) mSuX . That is, the state p is a thermal 
state that is in thermal equilibrium with temperature □ 

Let $ be a lossy channel that maps an m mode Gaussian state to an m mode 
Gaussian state. By definition, 



C H sw{$) > = sup 



(317) 



where p = J2 x PxPx- Since the states p x are infinite-dimensional states, the 
right-hand side of Eq. (317) becomes arbitrarily large if we do not impose 
some constraint on the signal states. Here, we take the energy constraint 

m 

5> fc iVk = £ (318) 

k=l 

and write Chsw(&, £) instead of Chsw ($) as the HSW capacity for the chan- 
nel $. In Eq. (318), uj], denotes the frequency of kth mode and Nj, stands 
for the average photon number of the kth mode of the average input state; 
Eq. (318) describes the constraint that the energy (excluding the zero point 
oscillation energy) of the average input state p should be £. 

Now we take the tensor product of coherent states 



p(m 1? m 2 , • • • , m m ) = P( %mi ) <8> P( 7 ,m 2 ) <S> • • ■ <S> P( 7 ,m m ) 

= |ai) (ai| <g> |a 2 ) (a 2 | <8> ■ • • ® |a m ) (a m | (319) 

for the input signal state and assume that the probability distribution of the 
displacement of the kth. mode takes the form, 
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instead of optimizing the signal ensemble in the right-hand side of Eq. (317). 
In Eq. (319), 7 = diag(l, 1, • • • ,1,1) and m k = y/2a k (k — 1, 2, • • • , m). 



The output state $>(p x ) is still a coherent state [245]. This is easily seen by 
Eqs. (314), (315), and (316). The average output state is calculated as 

/m 
Yl dm k Pk(m k )p(m lt m 2 , • • • , m k ) = p (7l0 ) <8> P( 72 , ) ® • ■ ■ ® P( 7m ,o), 
fc=i 

where 7^ = diag(H-2pfciVfc, l + 2r]kNk). That is, the state $(p) is a tensor prod- 
uct of thermal states with average photon numbers r) k N k (k = 1,2, •■ ■ , m). 
Since the state $(p x ) is pure, S ($(p x )) = so that 

m 

x k=l 



Therefore, we have 



C HSW (^,£) > vaax^g(ri k N k ), (321) 
Nk k=i 

where maximum in the right-hand side of Eq. (321) is taken for all N k satis- 
fying the energy constraint (318). 

Next, let {p* , p* } be the optimal signal ensemble, which gives the capacity 
C HSW ($). Since S (<5>® n (p* x )) > 0, we have 



C HSW (<$>,S) < lim -S(^ n (p*) 

n— >oo fi \ 



with p* = J2xP x Px- By the subadditivity of the von Neumann entropy [246], 
we have 

n m 
1=1 k=l 

where &(p k ) is the reduced density operator of the kth mode in the Zth 
realization of the channel, which is obtained from ^""(p*) by tracing over all 
the other modes and over the other n — 1 channel realizations. Now, let 
be the average photon number of the state p k 1 ' so that the average photon 
number of the output state $(pj^) is rj k N^' . Since among all states with this 
average photon number, the thermal state has the maximal von Neumann 
entropy (Theorem 2), we have 



s($(p k l) ))<g(ri k Nl l) ). 
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Therefore 

i n m 

C HSW {%E)<Yrm -£5>(%Af)> 
u 1=1 k=i 

where the summation in the right-hand side is taken under the constraint 

k=i 1=1 " 

Note that n" 1 £f =1 ^fc } = ^ is the average photon number of the fcth mode 
of the average input state. Since d 2 g/dx 2 = —l/[x(x+ 1)] < 0, g is concave so 
that 

i n m m In AT^' \ m 

-EE gimN?) < E 9\ E < E ^Mfc)- 
" j=i fe=i fe=i \/=i n ) k k=i 

Therefore, 

m 

C H sw(®,£) < nmxJ^giVkNk), (322) 
Nk k=i 

where maximum in the right-hand side is taken for all Nk satisfying the energy 
constraint (318) again. From Eqs. (321) and (322), we have 

m 

C H sw(®, S) = max V g(r]kN k ). 
Nk k=i 

The right-hand side is the energy-constrained classical capacity of the lossy 
channel. Note that the energy-constrained Holevo capacity is weakly additive; 
^ ($® n ) = n ^ ($) an( i the optimal signal ensemble is given by Eqs. (319) and 
(320). 



6.3 Gaussian Channels with Gaussian Inputs 



It is conjectured that the optimal signal states for Gaussian channels are 
Gaussian states [247]. However, it is not proven yet so that we have 

Chsw&S) >C g {$,£) (323) 

in general. Cg{®,£) denotes the HSW capacity of the Gaussian channel $ 
for Gaussian state inputs under the energy constraint specified by S, which is 
given in terms of the energy-constrained Holevo capacity for Gaussian state 
inputs or the Gaussian Holevo capacity [248], 



Xg($,£)= sup 

MiP(7,m) 



S($(jp)) - / /x(d7, dm)S($(pfr >m) )) 



(324) 



where 

p = I /i(dj, dm)p {l , m) 
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is the average signal state. In Eq. (324), the supremum is taken over all possible 
probability measures /i and signal states P( 7 , m ) constituting the signal ensemble 
under the energy constraint 

TipH = 8 (325) 

with 

n , 1 \ 1 n 

H = u k ( a\a k + - ) = - (Rlk-i + Rlk) ■ 

k=i v z/ z k=i 

The right-hand side of Eq. (323) is given by 

C G (*,£)= lim - XG (^ n ,^ n ). 

n—foo n \ i 



Some properties of the capacity of Gaussian channels are greatly simplified if 
we restrict the signal states to Gaussian ones. In the rest part of this section, we 
discuss the additivity properties of Gaussian Holevo capacity. Let us recall that 
the von Neumann entropy of a Gaussian state depends only on the covariance 
matrix, and that channel $ affects only the covariance matrix. Therefore, if we 
find a single state P( 7 *, m ) that minimizes 5*($(p)), all possible Gaussian states 
p with the covariance matrix 7* also minimizes S(&(p)). This observation 
indicates that the optimal signal ensemble that attains the Gaussian Holevo 
capacity consists of Gaussian states with the common covariance matrix 7* 
and a certain probability distribution of the displacement m. If we restrict 
the signal ensemble to that described above, it suffices to take a Gaussian 
probability distribution for the probability measure /i(g?7 , dm) = p,(dm). This 
is shown as follows [240]. If p J (dm) is a Gaussian distribution; 



pi{dm) 



7r n ,/det Y, 



exp(— rriFY^ 1 m)dm 



with Yfj, > 0, the average input signal state is calculated as 



p = / p(dm)p {l ^ m) = p (7 +y M ,o)- 



(326) 



That is, p is also a Gaussian state with the covariance matrix 7 = 7 + !^ and 
has the vanishing displacement. Equation (326) even holds for Y^ > 0. Since 
the displacement of p is zero, 



1 n 

TrpH = -5>* ((i4-i 
A k=i 



P 2 



1 - 

^ fc=l 



where 



7 W 



72fc-l,2fc-l 72fc-l,2fc 
\ 72fe,2fc-l 72fc,2fc 



137 



so that the energy constraint [(325)] is written as 

n 

5> fe lY( 7 + y M ) [fe] = 4£. (327) 

k=l 

Since such a signal ensemble described above is not always optimal, we have 
XG (®,£)> sup [Styfr + Yj) -5(0( 7 ))], (328) 

7,^(>0) 

where the supremum is taken under the constraint (327). In Eq. (328), S*(0(7)) 
stands for the von Neumann entropy of Ptj,M, the Gaussian state with covari- 
ance matrix 0(7). Hereafter, we have occasions to write the von Neumann 
entropy as £(7) instead of S(p 1 ) when we are dealing with Gaussian states. 
Note that the right-hand side of Eq. (328) is written as 

sup 5(0(7)) - inf ,S(0( 7 )) = sup 5(0( 7 )) - 5 min ($), (329) 

7 7 7 

where the supremum is taken under the constraint 

n 

Y, Tr^ fc 7W = 4£ . (330) 

k=l 

In Eq. (329), 

S min ($) = infS($(p)) 

defines the Gaussian mimimum output entropy and Q denotes the set of all 
Gaussian states. By Theorem 1, we can see that for Gaussian signal state P( 7 , m ) 
and the probability measure ^(d'jjdm), the quantity within the brackets of 
the right-hand side of Eq. (324) cannot exceed the value of the right-hand side 
of (328). Therefore, the equality holds in the inequality (328); 

Xg(®,£) = sup 5(0(7)) -5 min ($). 

7 

Again, the supremum is taken under the constraint [Eq. (330)]. 

Let 8 be the value for the energy constraint [Eq. (318)] for the Gaussian chan- 
nel $j and £ = J2JLi £j- From the definition, the Gaussian Holevo capacity of 
the tensor product channel is greater than or equal to the supremum of the 
sum of the Gaussian Holevo capacity of individual channels; 

m 

Xg(®,£)> sup J2xG{^j,£j). (331) 

Here, the supremum is taken over all possible combinations of £j under the 
constraint J^JLi^j = £■ If the equality holds in the inequality (331), we say 
that the energy-constrained Gaussian Holevo capacity is additive for Gaussian 
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channels $j. Now let p be a Gaussian state on the composite Hilbert space 
Td ® • • • ® H m and define = Tr Hl ®... mj _ imj+1 ®... mm p. By noting the 
subadditivity of von Neumann entropy [246], S(p) < Y^Li S(pj), we have 

m 

W)<E%-(7j)). 

i=i 

where 7^ denotes the covariance matrix of the Gaussian state pj. Therefore, if 
the minimal output entropy 5 , m ; n ($) is additive for the channels 

(m \ m 

3=1 ) 3=1 

then 

m 

xg(®,£)< SUp Y,XG($j,£j)- 

{£i}-E7=i £ i= £ i=i 

This implies the additivity of the energy-constrained Gaussian Holevo capac- 
ity; 

m 

XG {®,£)= SUp Y,XG($j,£j)- 

{ej},Y^ =1 £j=e 3=1 

Due to Eq. (307) the additivity of the Gaussian mimimum output entropy is 
implied by the multiplicativity of the Gaussian maximal output p-norm for 
p -> 1+- 



where 



u'=i / 3=1 



e P ($) = su P ||$(p)n p 

pee 



defines the Gaussian maximal output p-norm. 

Serafini et al. [239] proved that the Gaussian maximal output p-norm of a 
tensor product of identical single mode Gaussian channels and that of single 
mode channels described by X { and Yi [(306)] such that detXj are identical 
and Yi > for all i, are multiplicative for Gaussian state inputs for p > 1. 
Consequently, the Gaussian minimal output entropy and energy-constrained 
Gaussian Holevo capacity are additive for such tensor product channels. Hi- 
roshima [249] also proved the multiplicativity of the Gaussian maximal output 
p-norm of a tensor product of classical noise channels of arbitrary modes and 
that of thermal noise channels of arbitrary modes. Therefore, the Gaussian 
minimal output entropy and energy-constrained Gaussian Holevo capacity are 
additive for such tensor product channels. 

The additivity properties of Gaussian channels under Gaussian state inputs 
are shown to be equivalent to the additivity of Gaussian entanglement of 
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formation Eq defined by Wolf et al. [250] , which is an entanglement monotone 
under Gaussian local operations and classical communication (GLOCC) [216]. 
By definition, Eq is an upper bound for the true entanglement of formation 
Ep for Gaussian states. However, for symmetric two-mode Gaussian states, 
Eq coincides with Ep [250]. Furthermore, Eq is additive for symmetric states 



As mentioned earlier, only lossy channels within the class of Gaussian channels 
are proven to exhibit additivity properties - additvity of energy-constrained 
HSW capacity and the minimum output entropy. For general quantum chan- 
nels, the additivity question is still an open problem. Despite many efforts 
devoted to the additivity problems of quantum channels, the additivity prop- 
erties have been proven for a few examples, such as entanglement breaking 
channels [251], unital qubit channels [252], depolarizing channels [253], and 
contravariant channels [254]. 



6.4 Dense Coding with Gaussian Entanglement 

The dense coding scheme in continuous variable systems was discussed by Ban 
[72] and Braunstein-Kimble [73]. In this section, we introduce the Braunstein- 
Kimble's scheme of dense coding. 

Suppose that Alice and Bob share initially the two-mode squeezed state p\ 2 = 
U(r) |0) (0| U^(r), where U(r) = exp[— r(a\ai — a 2 a 2 )] is the two-mode squeez- 
ing operator with r being the squeezing parameter (r > 0). The mode 1 (2) 
is in the possession of Alice (Bob). The characteristic function of the shared 
state P12 is given by 



W(ai, ai) = — / d 2 r} x / d 2 n 2 exp^c^ - ^aj) exp(77*a 2 - r] 2 a* 2 )x(vii V2) 



where the subscript R{I) refers to the real (imaginary) part of ct\ ± a 2 . Now, 
Alice performs a unitary transformation, 



[250]. 



xivi, V2) = Tr[pi2 exp(?7ial - r/Jai) exp(77 2 a 2 - n* 2 a 2 )} 



so that the Wigner function takes the form, 




= — exp -e (ai-a 2 ) R -e (a 1 -a 2 ) I 

2r / \ 2 2r / \ 2 

-e [a\ + a 2 ) R - e («i + a 2 )j , 



D(a in ) = exp(a in a\ - a- n ai) 
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on the mode 1 to encode her message characterized by the displacement «j n . 
The state p\ 2 is transformed as 

P12 D(a in )p 12 D ] {a in ) = p 12 . (332) 

The characteristic fucntion of p' 12 is computed as 

x'(Vi,V2) = exp(-77*a in + r/ia* n ) 

so that the Wigner function of p' 12 takes the form, 

W'(ati, a 2 ) = W(a 1 - a in , a 2 ). 

After Alice send her state (mode 1) to Bob via a noiseless channel, Bob receive 
the state and he has the state of Eq. (332) in his hand. Bob's task is to decode 
Alice's original signal a{ n . To this end, Bob performs a unitary transformation 
on p' 12 represented by a 50-50 beam splitter; a\ — > (a± + a 2 )/v2 and a 2 — > 
(«i — a 2 )/ y/2. If he measured Reai and Ima 2 by an ideal balanced homodyne 
detection with the measured results am and a 2 j respectively, Ima^ and Rea2 
would be completely uncertain and the Wigner function of the state would be 
reduced to 



dlmai / dHea 2 W' 



a± + a 2 ai — a 2 



2e r 

— exp | — 2e r 

7T 



a 
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W"(a) 



where a = am + i&n- This represents a highly peaked distribution about 
the displacement ai n /y/2 and gives the conditional probability P(a\a in ) of 
obtaining a given an original message a in . Let a in be distributed as 



P(ou 



7TO" 



1 / \OLin\ 

— exp - 



Thus, the probability of obtaining a is computed as 

2 



Pa) 



d ai n P(a\a in )P(ai n) 



2 i „-2r 



ix [o + e 



exp 



2 \a\ 



a 2 + e 



-2r 



and the mutual information that is accessible to Bob is calculated by Eq. (300) 



as 



H d {A :B)= d 2 a in d 2 aP{a\a in )P{a in ) In 



P(a\a in ) \ 

Since the average photon number of mode 1 is given by 

n(a in ) = Tr (pi 2 al a i) = Win? + sinh 2 r, 



ln(l + aV r ). 



(333) 
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the average photon number of the average input signal state is computed as 
n = J d 2 a in P(a in )ri(ai n ) = a 2 + sinh 2 r. 

For fixed n, the mutual information [Eq. (333)] is maximized when a = 
V sinh r cosh r (n = e r sinh r) , yielding the dense coding capacity of 

Cd = ln(l + n + n 2 ) ~ 4r, r — > oo. 

Now, we recall that the thermal state maximizes the von Neumann entropy 
if the average photon number n of the mode is fixed (Theorem 2). Thus, 
the signal ensemble with pure signal states and the probability distribution 
such that the average input signal state is a thermal state achieves the HSW 
capacity of noiseless quantum channel under the fixed photon number; 

C H sw = g(n). (334) 

Substituting n = e r sinh r into Eq. (334), we find Chsw ~ 2r for r — > oo. That 
is, the dense coding sheme presented here allows twice as much as information 
to be encoded; Cd ~ 2Chsw for r — > oo. 

6.5 Entanglement measure 

7 Estimation theory for Gaussian states 

In this section, we treat state estimation theory in the three methods, the 
Bayesian method, the group covariant method, and the unbiased method. For 
the preparation of this topic, we first discuss information quantities for one- 
mode bosonic quantum system in Subsection 7.1. Next, we treat the measure- 
ment theory for this system in Subsection 7.2. In particular, the heterodyne 
measurement is explained in this section. In Subsection 7.3, we give the math- 
ematical formulation of the estimation theory. In Subsection 7.4, we consider 
the case many copies of the unknown state. Then, we show that the estima- 
tion problem with n copies can be resulted in the estimation with that with 
the single copy when the unknown parameter is the expectation of the filed 
operator of the unknown Gaussian state. We treat the estimation theory by 
the Bayesian method, the group covariant method, and the unbiased method 
in Subsections 7.5, 7.6, and 7.7, respectively. In these subsections, we show 
the optimality of the heterodyne measurement. Finally, we briefly treat the 
simple hypothesis testing in the Gaussian case. For the estimation theory for 
other state families and a more deep analysis of the simple hypothesis testing, 
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see Hayashi [231]. Since our analysis treats the estimation of displacement 
parameter, it can be extended to the estimation of displacement parameter 
for squeezed Gaussian states family whose elements are given by the Gaussian 
mixture of the squeezed states. For this extension, it is sufficient to replace 
the annihilation operator a by the operator cosh ra — e~ % ^ sinh ra^. 

7.1 Information quantities 

The essence of information theory is describing the operational bound based 
on the information quantities. Hence, as a preliminary, we need to give con- 
crete expressions of these quantities in the case of Gaussian states p^jj := 

-= J c |a)(a|e n da. In order to express the difference between two states, 
we often treat the relative entropy as 

D(p\\a) :=Trp(logp-a). 

Since the equation D(p\\a) = D(o~\\p) does not necessarily hold, the relative 
entropy does not satisfies the axiom of the distance. However, this value ex- 
press how large the difference between two state. Hence, it can be regarded as a 
kind of distance between two states. In the Gaussian case, it can be calculated 

D(p^\\p c ,n) = D(p ^\\p ( _ c ,jt) = iC-Cf log ^=Ji (335) 
As another quantity, Bures' fidelity 

F(p, a) := Tr \JyfpOyfp = Tr 

is known[255, 256, 257,258]. When the state p is a pure state \4>)(4>\, the its 
square equals the overlap probability between two states, i.e., 

F 2 (|0)(0|,a) = (0M0> 

Using this value, Bures' distance db(p, ex) is defined as 

d b (p,a) :=^1-Fi(p,a). 

It satisfies the axiom of distance. In the Gaussian case, this value is calculated 

as 

In order to treat the geometric aspect of the set of parametric set of states 
{po\ 9 G 6 C M. d }, we often focus on the metric of the family. This is because 
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the metric expresses the infinitesimal distance between two states. In the case 
of the set of probability distributions {pg(u)\9 G © C R}, Fisher information 



is used for this purpose in the one-parametric case. In the multi-parametric 
case, the metric defined from the Fisher information matrix: 

Jew ■= J — ^ w—rtu)** 

is used. This is because it is always equal to the constant times of Fisher 
information if a metric satisfies monotonicity for quantum operation. 

Hence, it is thought that Fisher information presents the information quan- 
tities. Moreover, using this property, we can characterize the bound of the 
accuracy of estimation by Fisher information. 

However, in the quantum state case, there are several information quan- 
tities satisfying this invariance. Hence, there is arbitrariness of the quan- 
tum version of Fisher information. This arbitrariness is caused by the ar- 
bitrariness of the quantum version of the logarithmic derivative. In the one- 
parametric case {pe\9 60C M}, three quantum versions are known. When pg 
is non-degenerate, one is the symmetric logarithmic derivative (SLD) Lg[259]: 
| (L e p e + pgL e ) = Other are the right logarithmic derivative (RLD) L e [260]: 
pLg = and the Kubo-Mori-Bogoljubov (KMB) logarithmic derivative 
L e [261,262]: L e = ^p. In the above definition, the SLD L e and the KMB 
logarithmic derivative Lg are Hermitian while the RLD Lg is not necessarily 
Hermitian. Based on these logarithmic derivatives, we can define three quan- 
tum analogues of Fisher informations, SLD Fisher information Jg»[259] , RLD 
Fisher information Jg[260], and KMB Fisher information Jg[261,262]: 

J e := Tr p d L 2 e , J e := Tr p e L e L\, J e := Tr p e L 2 e . (336) 

These information quantities are closely related to differences between two 
states. The SLD Fisher information Jg is characterized as the limit of Bures' 
distance[263,264]: 

4 

and the KMB Fisher information Jg is by relative entropy[261]: 

2 1 
J e = lim— D(p e || p e+€ ) = lim— D(p e+e \\pg). 
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Moreover, these Fisher informations satisfy the relation [262]: 



Je < Je < Jo- 

In the multi-parametric case, based on the the partial derivative for the fc-th 
parameter we can similarly define the logarithmic derivatives for the k- 
th parameter Lg-k,Lg-k, and Lg-k- Hence, the SLD Fisher information matrix 
-70;/c,z[265], the RLD Fisher information matrix Je ; fc 5 j[260], and the KMB Fisher 
information matrix Je.^[261] are defined as 

Jd;l,k '■= Tr pgLg. k O Lg-i, Jg-^k '■= Tr pgLg. k j) e .p Jg-l^k '■= Tr pgLg. k Lg.[. 

In the Gaussian case, i.e., {P(g 1+ ig 2 )/^/2jf\9 £ R 2 }, these matrices Jg = [Jg-k,i][265], 
Jfl — [<^0;fc,z][26O], and Jg = [Jg- t k,i\ are calculated as 





N+l/2 i/2 
) \ _,/ 2 7V+1/2 



J* 1 



N+l/2 i/2 
-i/2 N+l/2 



(337) 



Further, if the state family is parameterized by a complex number as p z , z G C, 
we often use the following Fisher information [266]. 

1 rp t yt T 

J z := Lrp z L z L z , — — = p z L z . 



dz 



In the Gaussian case [266], we have 



dpg 



,N 



09 N r 
Here, we use the formula 



* (at- 3)^, Je = =^j. 



(338) 



p e w(a j - 9) 



N 
N+l 



y - 9) P 



e.N- 



(339) 



7.2 Measurement theory 



In the quantum system, any measurement can be described by positive op- 
erator valued measure (POVM) M. If the set of the measuring data Q is 
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discrete- valued, the POVM M can be given by the set of positive semi-definite 
operators {M^j^j) satisfying 



M w = I ( or / M u daj 



where the identity operator is described by /. When the state of the system 
is given as the density p, the measurement data obeys the distribution 



P p m (uj) = TrM ul p. 

If any element M u is a projection, it is called a projection valued measure 
(PVM). 

In the single-mode bosonic system L 2 (IR), the number detection is described 
by the POVM {|^)(^|}^o- When the state is given as the coherent state \a), 
the data obeys the Poisson distribution |(ri|a)| 2 = e _ l Q l 2 ^L-IL. 

When the set Q of measuring data u> has continuous values, the POVM has the 
integral form M(dw). That is, for any integrable subset Bcfi, the operator 
J B M(du>) is positive semi-definite, and the total operator J Q M{dui) is equal 
to the identity operator /. In particular, if any partial integral J B M(du) is a 
projection, it is called a projetion valued measure (PVM). 

In the single mode bosonic system L 2 (IR), the measurement of the position 
operator Q is described by its spectral measure Eq(dq), and that of the mo- 
mentum operator P is by its spectral measure of Ep(dp). The simultaneous 
spectral measure of P and Q is impossible. However, when we focus on the 
two mode system L 2 (IR)® 2 = L 2 (IR 2 ), we can simultaneously measure the op- 
erators -^(-Pi + P2) an d (Qi — Q2) because they are commutative with each 
other. Using this property, we can jointly measure the operators P and Q as 
follows. Assume that we prepare the main target bosonic system L 2 (IR) with 
arbitrary state and the (additional) ancilla bosonic system L 2 (IR) with 

the state |0o)(0o|- When we perform the measurement corresponding to the 
simultaneous spectral measure of -^(Pi + P2) an d ^ (Qi — Q2), the data p 
and q obey the distribution 

Pip, q) = \(*l> ® ^o\^(Pi + P2) = P, ^={Qi ~ Q2) = q)\ 2 



Z7T J-00 

° e lV * pq "iP(q")Mq" ~ V2q)V2dq"\ 2 



1 

7T 



2?r 

(T \D(V2q,V2p)\ilj) 



00 

2 



where q" = Note that D(s,t) = e i( - sQ ^ = D{a) = e iaa+ia * a \ where 
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a = Therefore, if we regard this protocol as the measurement for the 
main target bosonic system L 2 (IR 2 ), it is described by the POVM 

-D(a)\ip )(ipo\D(a>ydqdp, 

7T 

where a = p+iq. When (^o IQ2 l^o) — (^ol-f^l^o) — 0, the average of p, q,p 2 , q 2 , 
and pq are calculated as 

pTr p-D(a)\^ )(f \D(a)Updq = Tr ±={P X + P 2 )(p ® |^o)(^o|) 



|- X 1 

/ qTx p-D(a)\i)Q){%l)o\D(a) ] dpdq = -^TrQip, 

JR" 2 7T a/2 



and 



2 



p 2 Tr p—D(a)\ifjo}{ipo\D(a>ydpdq = Tr ( + P 2 ) ) (p ® |^o)(^o|) 
! 7T \v2 / 

= ^((TrP 1 2 p) + (^o|P 2 >o)) 
g 2 Trp-D(«)|^)(^|P(a)t^g= i((Trg 2 p) + ^ |g 2 |^ )) 

! 7T Z 

gp'B:piD(a)|^)(^|£)(a)tdpd g = ^((TrQi o P lP ) + (^ |g 2 o P 2 |^ )), 
where Q\o P± :— QiEi±EiQx_ Hence, the covariance matrix is given by 

I I TrP 2 p TrQ l0 P lP \ \( (TrP lP ) 2 (Tr P lP )(Tr Q lP ) 
2 \TiQ l oP l p Trg 2 p J 2 1 (Tr P lP )(Tr g lP ) (Trg lP ) 2 



1 

+ 2 



(VoiPiiV'o) (^oig 2 op 2 |^o)) 
(^oig 2 op 2 ^o) (V'oigiiV'o) 



(340) 



That is, the accuracy of this measurement depends on the choice of the ancilla 
state ipo. For example, if we choose the vacuum state |0) as the ancilla state 

ipo, the last term equals |/ 2 . In this case, this measurement has the form 
^\a)(a\da, and is called the heterodyne measurement. If we perform this 
measurement to the system with the coherent state | ck) (a | , the data obeys 
the Gaussian distribution ^e~' a_ ^ . Hence, if the state of the system is Gaus- 
sian state p^]v = Ic \P)(P\ e ~~ N< ^ ne data obeys the Gaussian distribution 
i«-ci 2 

7r(i+lv) e 1+N ' ^ ^ e sc L ueeze d state |C, 0) is choosed as the ancilla state ipo, 
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the last term of (340) is equal to a real symmetric matrix S with determinant 
j. In addition, when p is the Gaussian state p^jf, the above matrix is equal to 

(N+±)I 2 + S. (341) 



Indeed, the heterodyne measurement ^|a)(a;|(ia; not only satisfies the condi- 
tion 

f a 

a= / -|a)(a|da, (342) 

JC 7T 

but also can be regarded as the measurement of the annihilation operator a 
because of the following reason. Assume that a POVM M(da>) satisfies the 
condition 




Then, we obtain 

aa ] > f M(da) (343) 
Jc 

because 

aa) — / \a\ 2 M(da)= \ (a — a)M(da)(a — otfda > 0. 

We can easily check that the heterodyne measurement -\a)(a\da satisfies the 
equality of the above inequality. Using this inequality, we can evaluate the 
variance V P (M) of the measuring date in the following way when the state is 
given as the density p 

Vp(M) = Tr p / |a| 2 |a)(a|(ia — | Tr pa\ 2 < Tr pact) — \ Tr pa\ 2 . 
Jc 

Hence, if the equality of (343) holds, the measurement can be regarded as the 
optimal measurement for the annihilation operator a. Since the heterodyne 
measurement -\a)(a\da satisfies its equality, it can be regarded as the optimal 
measurement of a. 

Moreover, the annihilation operator has the form a = \% , hence, the het- 
erodyne measurement can be treated as the optimal joint measurement of the 
operators Q and P. 

In particular, when the state p is a Gaussian state p^ ^, we obtain 

V p (-\a)(a\da) = N + 1. (344) 
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Indeed, as is discussed latter, this POVM is used for the estimation of the 
unknown parameter of the Gaussian state. 

In order to realize this measurement, we need to treat quantum correlation be- 
tween two bosonic systems. However, the required correlation can be perfumed 
only by the beam splitter (Sec 1.5). 

7. 3 Formulation of estimation 

In the quantum theory, in order to obtain any information from the system 
of interest, we need to perform a measurement to the system. Needless to 
say, the measurement always causes the demolition of the state of the system. 
Hence, the choice of the measurement is crucial. In this section, in the case 
of Gaussian state, we optimize the measurement for the estimation of the 
prepared unknown state. 

In the estimation theory, we usually assume that the true density p belongs 
to a given state family S = {pe\9 e 0}, where is the parameter space. For 
simplicity of our analysis, we often assume that the set is finite-dimensional. 
In this case, the estimator is given by a POVM M(d8) taking the measuring 
data in the parameter space 0, i.e., the POVM is continuous-valued. Hence, 
when we use the estimator M and the true parameter is 9, the estimated 
value 9 obeys the distribution Tr M(d9)pg. In order to treat the accuracy of 
our estimation, we focus on the risk function W{9, 9), which describes the 
degree of the miss-estimation when the true parameter is 9 and our estimated 
parameter is 9. Thus, the accuracy of the estimator M is evaluated by the 
mean risk: 

Vf{M):= ( W(9,9)TrM(d9)p . (345) 
Je 

In the statistics, when the parameter space is a subset of R, we often adopt 
the square error (9 — 9) 2 as the risk function W(9, 9). In this case, the mean 
risk: 

MSE g (M) := J (9 -9) 2 Trp e M(d9) (346) 

is called the the mean square error (MSE). When the parameter space is 
C, i.e., the family has the form {p z \z G C}, the MSE is given by 

MSE Z (M) := J \z-z\ 2 Trp z M(dz). (347) 

In the multipara-metric case, we often adopt Y,k=i(@ k ~ @ k ) 2 as the risk function 
W{9,9). In the quantum theory, we often use 1 — F 2 (p e ,pg) or the square 
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of Bures' distance dl(pe,p^) as the risk function. Usually, we assume that 
W(9, 9) > and the equality holds if and only if 9 = 9. 

7.4 Independent and identical condition 

In the statistics, we often assume that the data are independent, identically 
distributed (i.i.d.) with the unknown probability distribution GO- Based on this 
assumption, we can easily treat estimation theory in the case where the number 
n of data is large, i.e., in the large sample case. This is because asymptotic 
expansions are available in the large sample case. 

In the quantum case, when each system is prepared in the same state p, the 
state of the n-fold system 7-t® n is given by the n-fold tensor product state p® n . 
This setting is called the (quantum) n-i.i.d. case One may call the state p® n 
n copies of p. 

In the Gaussian case, the n-fold tensor product state p®^ is unitarily equiv- 
alent with p jy <g> pfjj- In order to construct the above unitary U, we gen- 
eralized the discussion for beam-splitter, for any n x n special unitary matrix 
Mb, there exists a unitary operator Ub on L 2 (IR n ) such that 

U B {a\,...,ai)U B = (al,...,4)M B . 

If the special unitary matrix Mg has the form 

\~h * ••• */ 

the unitary operator U b satisfies 

UBP^U B = p^®p^. 

Since the state p®^ has no information concerning the (, the estimation 
problem with n copies can be resulted in the estimation with the family 

WhcaK g C}. 

3 Currently, many mathematical statisticians treat dependent data, and they ob- 
tained several basic results similar to the i.i.d. case. However, the discussion of the 
dependent case is so difficult that we mainly focus on the i.i.d. case in this paper. 



M, 



B 
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In the following, we prove the optimality of the heterodyne measurement 
-\a)(a\da for the Gaussian family {p^jj\( G C}. in the respective formu- 
lations. 



7.5 Bayesian method 

The minimum value of the mean risk T>Y{M) is when the estimated param- 
eter is always 9, however, it is impossible to minimize the mean risk T>Y(M) 
simultanouesly to all 9. Hence, we have to trade-off T>q(M) with all elements 
9 in 

the parameter space 0. As one method for this trade-off, Bayesian method is 
known. In this approach, we assume that the known parameter 9 is generated 
the prior distribution p on the parameter space, and minimize the average of 
the mean risk 



V™{M)p{d9). 

e 



In the one-parameter case {pe\9 6 C M.}, the Bayes estimator (the optimal 
estimator of Bayesian approach) concerning the MSE is given as follows [267]. 

f [ (9- 9f Tr Pe M(d9)p(d9) = Tr / (p6 2 - (Lp + pL)9 + S) M(d9) 

JR JR JR V ' 

= Tr [ (L — 9)p(L - 9)M(d9) + S - LpL, 

JR 

where the operator p, L, and S are defined by 

p := / PB fi(d9), S := / 9 2 p e p(d9) J (Lp + pL) = 2 [ 9p e p(d9). 

Jr. Jr Jr 

The equality of the inequality 

Tr / (L - 9)p(L - 9)M(d9) > 
Jr 

holds if and only if the POVM M is equal to the spectral measure of the 
operator L. Hence the optimal estimator is given as the spectral measure of 
the operator L, and its optimal error is equals Tr S — LpL. 

If we apply the same method to the two-parameter case, we have to consider 
a simultaneous spectral measure of two operators, which correspond to the 
respective parameter. Since such a simultaneous spectral measure is impossible 
generally, this problem of the two-parameter case is more difficult. However, 
its Gaussian case can be solved when the prior is the Gaussian distribution. 
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In this case, the Bayes estimator concerning the MSE can be obtained by the 
following calculation: 



TlNi Jc 

Tr _ 1 _ 

tt^N + N^Jc 



\6 -6\ 2 Trp e M(d6)e »i d9 

2 



iVi 



Nx + N 
Ni 



\a)(a\e N i+ N daM(d9) + JVi - — — 



Po,N!+N a 



W^W) ^,N 1+ N^)M(d9) + =-^= 



Trf _ N ± J -9* 



iVi + iV 



iVx + iV (JVi + iV+ l)(iVi + AT)' 

where the second equation follows from (339) and the final equation follows 
the next equation: 



V^ttI (N 1 + N)-(= 



Ni + N + 1 



Q Po,iVi+7V a 



iVi + 7V 



Ni + N + 1 



(iVi + iv + i; 



(JVi + JV + l)(Wi + iV) 
The equality of the inequality 

Ni 



Tr = 

ViVi + iv + i 

holds if and only if 



V — 9* } O n AT. I AT 



iVi 



M(d9) 



N 1 + N+lA I N x + N +1 



_ 9 



#1 



_ 

iVi 



d0. 



Hence, the minimum error is equal to — + _ — + — , and the optimal 

estimator is given by the above POVM, which is realized by the heterodyne 
measurement. This value is smaller than the error of the usual heterodyne 
measurement with the following value. 



N N X (2N +l) + N +N 

Ni + N + (N 1 + N +1)(N 1 + N)' 
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This difference goes to when Ni goes to infinity. 



7.6 Group covariant method 

However, we cannot use the Bayesian method when our prior knowledge is in- 
sufficient to decide the prior distribution. Hence, several non-Bayesian meth- 
ods, e.g., the minimax method and minimum variance unbiased estimation 
have been proposed. 

In the minimax method, we focus on the worst error for an estimator: 

maxZ>F(M), 

eee 

and optimize it. This method provides an attractive estimator when the family 
of probability distribution has a homogenous structure. In the Gaussian case, 
the state family {p^]y|C £ C} has the following group symmetry: 

Hence, if that risk function W(9, 9) is invariant for the action U, i. e., W(9, 9) = 
W{6 + 7], 9 + r]), the relation 

minmaxP^(M) = min VY(M) (348) 

M 06© Mxovariant 

holds, where the POVM M on C is called covariant if 

V{r))M{9)V{rj) ] d9 = M(9 + rj)S, 
which is equivalent with the following form 

M{9) = -V(9) ] P Q V(9)d9. 

71 

The relation (348) is called Quantum Hunt-Stein's lemma. (It was obtained by 
Holevo [268] when G is a compact group, and by Ozawa [269] and Bogomolov[270] 
when G is a non-compact group.) 

In the Gaussian states family {p^jylC e C}, if the risk function W(C> C) can 
be written by a monotone increasing function of |C~CI) the optimal estimator 
is given by the heterodyne measurement: That is, the optimal esti- 

mator does not depend on the form of the risk function, and depends only on 
the group invariance. This optimality can be proven by treating the following 
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case: 

f l IC-CI > R 
[o K-CI <R. 

In fact, this optimality has been shown by Cerf et al. [271] only when W is 1— 
fidelity and N = 0. 

In the above general case, using the operator W := ^ I\o>r U(()p jjU((yd(, 
we can describe the error T)^(M) as T>W(M) = Tr WPq. Hence, it is sufficient 
to show (0|VF|0) < (fc|W"|A;) for any integer k. For this proof, we focus on the 
equation 

r ( 1 l r ic-^i 2 \ , l2 \ a \ 2k 

(k\W\k)= / = / e~^dC, e~ H ^—da. 

S 1 17 7c \it ttN J\c\>R J k 

Since i|d>-R e ^~^C^j an d ^ir~ are mon °tone increasing function con- 

cerning \a\, the probability distribution e~' Q ' 2 <ia satisfies 

< f ( I-L / e'^c/cl e- |Q|2 ^rfa = (jfelT^lifc). 
~7c VvrvriV7|c|>fl 7 jfe N ' ' ' 

Therefore, we obtain the optimality of the heterodyne measurement in the 
group covariant model. 



7. 7 Unbiased method 



Finally, we consider minimum error under the unbiased estimators. In the 
statistics, we often restrict our estimators to the unbiased estimator, i.e., we 
assume that the estimator M of the family {pe\6 G M.} satisfies 

E fl (M) := f 6p e M(d6) =6, V# G 0. (349) 

And we minimize the mean square error (346) among unbiased estimators. If 
the estimator M satisfies the unbiasedness condition, the MSE is bounded by 
the inverse of the SLD Fisher information Jg (336) as 

MSE e (M) > (Je)' 1 . (350) 
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This inequality is called SLD Cramer- Rao inequality [259]. It can be shown 
by the Schwarz inequality as follows. Taking the derivative in (349), we have 

Tr((0(M) - 9) o L e )p = Tr(0(M) - 9){L e o p) = Tr(0(M) -0)^ = 1, 

da 

where O(M) = J 6M(d6). the Schwarz inequality implies that 

Tr(0(M) - Ofp ■ J e = Tr( (O(M) - 9) o (O(M) - 9))p 6 ■ Tr(L e o L e )p e 
>\Ti((0(M)-9)oL e )p e \ 2 = 1. 

Since 

j{9- Of Tr pM{d9) - Tr(0(M) - 9) 2 p 
= Trp J[{9-9)-(0{M)-9)]M{d9)[{9-9)-{0{M)-9)\ > 0, (351) 

we obtain inequality (350). 

If the parameter z is a complex number, we obtain another type of Crameer- 
Rao inequality [266]: 

MSE e (M) > (Jo)- 1 . (352) 

It can be shown similarly. The operator O(M) = J zM(dz) satisfies the 
Schwarz inequality: 

Tv(P(M) - z)\0{M) - z) Pz ■ J z = Tr p z (0(M) - z)\0{M) - z) ■ Tr p z L z L\ 
>\Tt Pz L z (0(M)-z)\ 2 = 1. 

Hence, using a inequality similar to (351), we obtain inequality (352). 

If we focus on the weighted MSE Wi(Ci - Ci) 2 + W 2 & ~ C2) 2 , the RLD 
Fisher information matrix is very useful. In this case, we focus on the Co- 
variance matrix: Cov(M) := (Y c (0 — Ci) (Ci — Ci) Trp^M(rf^)^, and minimize 
Tr G Cov(M) among unbiased estimators M, where G is a symmetric real ma- 
trix. Applying a discussion similar to RLD Fisher information, we can show 
[260] 

Cov(M) > J"!. (353) 
Since the matrix Cov(M) is real symmetric, any unbiased estimator M satisfies [260] 



TrGCov(Af)> min {TrGV\V > J7^} (354) 

V: real symmetric matrix 

= (N+ ^)TrG + VdetG. 
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In the last equation, we use equation (337). This value can be attained by S = 
^pG" 1 in (341) (V = (N + \)h + ^pG" 1 in (354)). That is, the optimal 
measurement can be realized by replacing the coherent state in the ancilla by 
the squeezed state. This discussion can be applied to the asymptotic theory 
of the state estimation in the quantum two-level system because the states in 
this system can be approximated by the Gaussian states in the asymptotic 
sense [272]. 

Now, we apply this inequality to Gaussian states family {p^jylC £ C}. Then, 
from (338), the minimum MSE among unbiased estimators is N + 1. From 
(342), the heterodyne measurement Jc^KXCMC is an unbiased estimator. 
From (344), this value is attained by the heterodyne measurement. That is, 
the heterodyne measurement is the optimal estimator even among unbiased 
estimators. Note that this discussion can be applied even in the pure states 
case. 

Next, we consider the estimation of another parameter N. Assume that ( = 
0. Then, the SLD L w is equal to E£°= (f ~ \n)(n\. Therefore, J w = 
■ The MSE of unbiased estimators is N(N + 1). This bound is attained 
by the number counting {|n)(n|}^ . However, if we use the heterodyne mea- 
surement, the MSE is (N + l) 2 , i.e., this bound cannot be attained. 

The advantage of this approach is that n-copy case can be treated just parallel 
to one-copy case. That is, we can easily construct unbiased estimator for the 
n-copy family from an unbiased estimator for the one-copy family. In this 
case, the bound (J#) _1 becomes the - times of the one of the one-copy case. 
Further, the MSE also behaves similarly. Therefore, in the n-copy case of 
the Gaussian states, the bound of MSE concerning £ is ±¥±1 : and the bound 
of MSE concerning N is N ( N+1 *> . For this simultaneous estimation, we first 
perform the state evolution as p®^ — > p <8> Pq^- Next, we perform the 
heterodyne measurement for the first state jf, and we perform the number 
counting for the remaining states p®^. In this case, the MSE concerning £ is 

^±1 and the MSE concerning N is M^±ii_ That is, this method is almost 

n ' ° n— 1 ' 

optimal even for the estimation of N. 

Hence, we can conclude that this measurement realize the simultaneous opti- 
mal estimation between the two parameters ( and AT [2 73]. 



7.8 Simple hypothesis testing 



Next, we treat the statistical simple hypothesis testing. In this problem, it 
is known that the unknown state is the null hypothesis po or the alternative 
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hypothesis p±. It is required to reject the null hypothesis po with a fixed error 
probability, and accept the alternative hypothesis p\. This problem is the sim- 
plest case of statistical hypothesis testing, and its mathematical formulation 
is well established even in the quantum case. 

In this case, if the null hypothesis is rejected despite being correct, it is called 
the error of the first kind. Conversely, if the null hypothesis is accepted despite 
being incorrect, it is called the error of the second kind. Then, we make our 
decision only when we support the alternative hypothesis, and withhold our 
decision when we support the null one. Now, we describe our decision by the 
two-valued POVM {T, / — T}, where the outcome of T supports pQ. This pos- 
itive semi-definite operator T is called a test. Then, the first error probability 
is equal to Tr p (I — T), and the second error probability is equal to Tr p{T. In 
this problem, it is required to keep the first error probability Tr po(J — T) less 
the fixed error probability. We minimize the second error probability Tr p{T 
under the above condition for the first error probability Tr po(J — T). That is, 
we often focus on the following value: 

&Oo||pi) := ™n o {Tr Pl T\Tr p (I - T) < e}. 

When we prepare the n copies of the unknown state, we treat /3"(pf "IIP?")- 
If the error threshold e is fixed, this value goes to exponentially. Hence, we 
focus on its exponential rate. In fact, the exponential rate is given as 

hm — log &"(pH =D(p \\ Pl ), 1 >Ve>0, 
n 

which is called quantum Stein's lemma [2 74, 2 75]. In the Gaussian case po = 
p£ jv and p\ = p^ jj, this bound is equal to |£o — Ci| 2 log (335). 

Indeed, when pi is not commutative with po, we need quantum correlation in 
the measuring apparatus for realizing the test T attaining the optimal bound 
D (poll Pi)- That is, if we perform any separable measurement, the bound can- 
not be attained [276]. In the above Gaussian case, the following test attains the 
bound. First, we perform the state evolution as p®^ — * p ^(n^Pqjj • Next, 

we perform the state evolution as p^ Ci iv ® P^? -> P^((-d),N ® Poj? ' 
Then, we perform the number counting for the first system. Finally, the de- 
tected number n is greater than the threshold, we support p^ ^. Otherwise, 
we support p^jy- For the threshold, see Hayashi [276]. In this test T n , the first 
error Tr p® n 7 r f (J — T n ) goes to and the second error Tr p® n -^T n goes to with 

the exponential rate |£ — Ci| 2 l°g ^w^[276]. This fact indicates the importance 
of the quantum correlation using the beam splitter. 
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See ther right form in Eq.(86) of this version. 

4) Eq.(245) is replaced by = (1 + r a )s a (n'), as used in this version. 

5) The text after Eq.(246) and before the paragraph prior to Eq.(248) is rewrit- 
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6) Eq.(250) is modified, as Eq.(250) in this version. 
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